The free check and the free tools
Check any domain without an account, compare it with similar public bodies, and use the thirteen free tools for e-mail, DNS, certificates, NIS2 and more.
Some of Perimetry Cloud works without an account: a free check of any domain, and thirteen tools for the questions that come up when you fix e-mail, DNS and certificates.
The free check
On the Free check page (or the home page), enter a domain and press Check it. In one to two minutes you get:
- the score and the grade of the domain, from the public checks: e-mail authentication, DNS, certificates, mail servers and websites;
- the three most serious findings. Those whose details could help an attacker are named by family only, until the owner of the domain proves it is theirs.
It is passive: nothing is attacked, there is no look-alike search and no probing of sensitive files. The same domain checked again within a day gives the same result. To keep the service fair, each network can run five checks an hour and twenty a day. We keep the summary seven days.
For a French public body (commune, intercommunality, département, region, university or school), the result also lets you compare the domain with organisations of the same kind: choose your kind of organisation under the result to see where it stands on the checks of Perimetry Research, check by check. The contact address check is left out, since a free check cannot see it. A business or an association can compare it with the .fr domains: all active .fr domains, or those of the same age, mail provider or kind of site (a random sample of the registry’s open data, whoever holds them).
For the full report with evidence and fixes, the history and the alerts, create a free account and prove that the domain is yours.
The free tools
| Tool | What it does |
|---|---|
| SPF record checker | Is the SPF record valid? Its syntax, the DNS lookups it costs against the limit of 10, include by include, duplicates, ptr, the all mechanism, and the cause of a permerror. |
| DMARC checker | Does the DMARC policy stop forged mail? Policy and subdomain policy, pct, alignment, where the reports go and whether those addresses accept them. |
| DKIM checker | The DKIM key of the selector you give, or of the common ones: key type and size, revoked keys and syntax errors. |
| Full e-mail authentication check | Can someone send mail in your name? SPF, DKIM and DMARC at once, with MX, MTA-STS, TLS-RPT, BIMI and an overall verdict. |
| E-mail header analyzer | Paste the headers of a message: its route server by server, the delays, SPF, DKIM and DMARC, and the signs of a forgery. |
| DMARC report reader | Drop the XML, .gz or .zip reports your rua= address receives: every server that sends mail as your domain, and which ones fail. |
| SPF record generator | Tick the services that send your mail and get one valid SPF record, its DNS lookups counted. |
| DMARC record generator | Choose the policy, the report addresses and the alignment, and get the _dmarc record. |
| DNS record generator: SPF, DMARC, CAA, MTA-STS, security.txt | Build the records that protect a domain’s mail and certificates, each setting explained, the SPF lookup count checked. |
| Certificate and security headers checker | Certificate validity and expiry, TLS version, HTTPS redirect, HSTS, CSP and the other headers that protect a site’s visitors, with a grade. |
| Subdomain finder and DNS map | A domain’s records, the subdomains its certificates reveal, the addresses behind them and who runs them (network, provider, country), on an interactive map with tables, CSV and an SVG or PNG export. |
| NIS2 scope checker: am I covered? | Your sector, your size, your country: whether NIS2 makes you an essential or an important entity, the article that decides it, and where the law stands in France, Germany and Ireland. |
| Resale calculator for agencies | Your number of client sites and your price per site: the plan you need, your cost, your monthly margin and break-even, with an offer and an e-mail to copy. |
The checkers, generators, header analyzer and report reader run entirely in your browser: what you paste or drop is never sent to us, and DNS lookups go from your browser to public DNS-over-HTTPS resolvers. The certificate and headers checker needs a server to reach the site, so it goes through our application, with a limit of twenty checks per network every ten minutes.
The DNS and surface map also goes through our application. It only reads public sources (DNS, the certificate transparency logs, RIPEstat routing data) and never connects to the hosts it finds. It is for cybersecurity research: tick the box that says so, which also accepts the terms of use. Each network can map two different domains per 24 hours; a domain already mapped opens again without counting, and a map is kept one hour. To follow your own domains without a limit, with their open ports and technologies, add them to Perimetry Cloud and prove they are yours.
When to use which
- Before publishing a new SPF or DMARC record, build it with the SPF or DMARC generator, then check it with the SPF or DMARC checker.
- A bounce or a header mentions an SPF permerror, DMARC or a DKIM failure: the SPF, DMARC and DKIM checkers explain the usual messages and their fixes.
- To see a domain’s whole e-mail setup at once, use the full e-mail authentication check.
- A message landed in spam or looks forged: paste its headers into the header analyzer.
- You want the list of your subdomains and who hosts each one: open the Subdomain finder and DNS map.
- Your DMARC reports pile up unread: drop them into the report reader, or let Perimetry Cloud read them every day.