Free security check of a domain
Enter a domain and get its score and its three most serious findings in about two minutes. No account, nothing installed, nothing attacked.
What is checked
- E-mail authentication: SPF, DKIM, DMARC, MTA-STS and TLS reporting, which decide whether someone can send mail in your name.
- DNS: DNSSEC, CAA, wildcard records and delegations.
- Certificates and mail servers: expiry, encryption, STARTTLS.
- Websites: security headers, Content-Security-Policy, cookies, security.txt.
- Subdomains and exposed services found in public sources, named by family only in the free check.
Questions
Is the free check safe to run on any domain?
Yes. It only reads what anyone on the internet can read: DNS records, certificates, the answers of mail and web servers. Nothing is attacked and no password is tried. The deeper checks (look-alike domains, sensitive files) run only after the owner proves the domain is theirs.
Why only three findings?
Some findings help an attacker as much as the owner: a subdomain that can be taken over, a server that bypasses the CDN. The free check names their family and severity; the full report, with evidence and fixes, needs an account and a TXT record that proves ownership.
What is kept?
The summary (score, counts, three findings) for seven days, so the same domain is not scanned twice in a day, and a keyed hash of the network you used, to limit abuse. Nothing else.
How is the score computed?
Each finding takes points off a hundred according to its severity. The same scale is used in the full reports and in the open-source scanner, so you can reproduce it.
Want the full report and a check every week? Create a free account or see the plans.