SetEnforce - Domain security and compliance

Automated domain security SaaS mapping scans to NIS2, ISO 27001 & NIST

by Nicolas Rosenbaum

Visit

Nov 1, 2026 Security & Privacy

automated audits compliance scanning domain security internet configuration standards-based

Gallery

About

SetEnforce (https://setenforce.org) is a domain-security and compliance platform. You give it a domain; it runs a deep, standards-based scan of the internet-facing configuration and tells you what is wrong, how serious it is, which compliance requirement it affects, and exactly how to fix it.

Most free scanners stop at a grade. SetEnforce goes further: findings are tracked over time, assigned as tickets, mapped to frameworks, and exported as reports an auditor can use.

What it checks

DNS and DNSSEC, DANE, CAA, DNS hygiene
Email authentication and transport: SPF, DKIM, DMARC, MTA-STS, BIMI, SMTP/TLS
TLS and certificate configuration
Web hardening: HSTS, CSP, cross-origin headers, security.txt
Routing security: RPKI origin validation
IPv6 readiness
Exposure checks for the external attack surface (SURFACE)
Over 100 individual check modules across 14+ standard plugins

What makes it different

Framework mapping built in. 11 packs: NIS2, ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1, PCI DSS 4.0.1, GDPR Art. 32, BSI IT-Grundschutz, BSI TR-03108, BSI TR-03116-4, NCSC Mail Check, and an internet.nl-aligned pack. Few tools map external scan results to the BSI technical guidelines.
Findings engine, not just a score. Each finding has a severity and risk score, evidence (what was queried, what was seen), a lifecycle (open, accepted, fixed, regressed) and a remediation text.
Evidence you can defend. Scan provenance records what ran, when and with which version. Active probes require a verified domain, so you can scan your clients' domains legally and say so.
Built for teams and MSPs. Organizations, asset inventory, portfolio view across many domains, an auditor role, remediation tickets with assignment, saved views, watchlists, scheduled reports, webhooks, SIEM forwarding and email/chat notifications.
Public growth surfaces. A public Hall of Fame scoreboard, verified embeddable badges (website, email, champion), a wiki knowledge base, and a /stats benchmark page with adoption statistics across scanned domains. All are built to bring in organic traffic and backlinks.
API-first. REST API with OpenAPI docs, personal access tokens with scopes, batch scanning, JSON/CSV/HTML reports, WebSocket live progress.
Hardened. CSRF protection, scoped API tokens, rate limiting and quotas, audit logging (four log tables), role-based access, GDPR user erasure, Turnstile captcha, etc.

Tech stack

Python, FastAPI, SQLModel/SQLAlchemy, PostgreSQL, Redis, Celery workers, Jinja2 templates, Tailwind CSS, vanilla JS (no heavy frontend framework), Docker Compose for dev and production.