Domain reputation — real DNS checks (SPF/DMARC/MX via Google DNS), HTTPS/SSL validation, security headers audit