What a Perimetry audit checks
45 checks in eight areas, all passive except one optional check you turn on yourself (administration logins): each one reads public DNS, public certificate logs, the response your server already gives to anyone, or a public data set. The severity shown is the usual severity of the finding; the report adjusts it to the context (a missing DMARC record on a domain that sends no mail is not the same as on your main domain).
E-mail authentication
Whether other people can send mail in your name, and whether receivers would notice.
Guide: SPF, DKIM and DMARC, explained for people who run websites
DMARC policy
Missing record, policy set to none, syntax errors, reporting addresses, subdomain policy.
SPF record
Missing, neutral or soft-fail endings, more than 10 DNS lookups, dead includes, loops, several records.
DKIM keys
Common selectors probed, key length estimated, revoked or empty keys.
Domains that send no mail
Null MX, reject-all SPF and reject DMARC on parked and brand domains.
MTA-STS and TLS-RPT
Policy file, mode, reporting address.
Mail transport
STARTTLS offered by your MX hosts, certificate validity, mail servers that no longer exist.
DANE
TLSA records of your MX hosts compared with the certificate each server presents, and whether DNSSEC really protects them: a mismatch or a failed signature makes DANE senders refuse your mail.
BIMI
When you publish one: the record, the SVG Tiny PS logo, the mark certificate (VMC or CMC) and the DMARC enforcement BIMI needs before any logo is shown.
DNS and registration
The foundations every other record depends on.
Name servers
Single provider, unreachable servers, delegations to hosts that no longer exist or to unregistered domains.
DNSSEC
Not enabled, or enabled and broken, which is worse.
CAA records
Which certificate authorities are allowed to issue for your domain.
Wildcard records
Catch-all records that make every subdomain resolve, including ones you never created.
Domain expiry
The expiry date and registrar read from the registry: expired, or expiring within 60 days (critical under a week).
Registry status
A domain on hold or being deleted by the registry, and a domain not locked against transfers (on generic extensions such as .com, .org or .io, where locks exist).
Subdomains and takeover
The hosts you forgot about, found in public certificate logs.
Guide: Subdomain takeover: how a forgotten CNAME becomes someone else’s page
Subdomain discovery
Every host name that ever received a certificate, from Certificate Transparency logs, and the hosts the Internet Archive kept, which never had a certificate of their own.
Subdomain takeover
Records pointing to cloud resources that no longer exist: GitHub Pages, Heroku, Azure, Shopify, Zendesk and 20 other providers.
Dangling records
CNAMEs to unregistered domains, which anyone can buy.
Cloud storage buckets
S3, Google Cloud Storage and Azure buckets named after your domain, and whether they are public.
Certificates and TLS
Expiry, trust, and who has been issuing certificates for your names.
Guide: Watching Certificate Transparency logs for your own domain
Certificate validity
Expiry within 30 days, expired, wrong host name, untrusted chain.
Protocol versions
TLS 1.0 and 1.1 still accepted.
Certificate Transparency watch
New certificates issued for your domain, by which authority, and whether your CAA record allowed it. Between audits too: the logs are read up to every hour on the Agency plans, every 6 hours on Solo and once a day on Free, with an alert when a certificate comes from a new or unauthorised authority or names a host never seen before.
Web configuration and privacy
What your main site tells every visitor in its first response, and what its home page loads.
HTTPS redirect and HSTS
Plain HTTP left open, redirect chains, missing or short HSTS.
Security headers
Content-Security-Policy quality, frame protection, referrer policy, permissions policy, MIME sniffing.
Cookies and CORS
Session cookies without Secure or HttpOnly, wildcard CORS with credentials.
Page content
Outdated JavaScript libraries, mixed content, login forms posting over HTTP.
WordPress
Version, exposed XML-RPC and user listing, plugins and themes checked against the Wordfence vulnerability feed.
Third-party scripts
Scripts loaded from other origins without Subresource Integrity (SRI), and any still loaded over plain HTTP. Tag managers, payment and captcha scripts, which cannot use SRI, are left out.
Where scripts come from
A script loaded from a domain known to have served malicious code (polyfill.io and its sister CDNs), or from a domain nobody owns any more, which anyone could buy to run code on your site.
Trackers before consent
Audience measurement, advertising and social trackers, and their cookies, loaded by the home page before any click, and whether a consent tool is present. A minimum: the page is read without running JavaScript.
security.txt
A way for researchers to reach you, checked against RFC 9116: contact, expiry date, canonical address, content type.
Administration logins (optional)
WordPress, Joomla, Drupal, phpMyAdmin and Adminer login pages, and admin or cPanel subdomains, reachable from the internet. Only with the sensitive file probing you turn on for a domain you own; nothing is typed or submitted.
CDN, firewall and HTTP/3
The CDN or web application firewall in front of each site (Cloudflare, CloudFront, Akamai, Fastly, Sucuri…) and whether HTTP/3 is offered, shown in the inventory, not scored.
Look-alike domains
Domains one typo away from yours, and whether someone has registered them.
Guide: Look-alike domains: spotting phishing before the first e-mail is sent
Typosquatting watch
Hundreds of variants per domain: missing letters, swapped letters, homoglyphs, other extensions, added words. Registered ones are reported with their mail server and website.
New registrations
A look-alike that appears between two audits is in the changes section of your next report.
Your brand in other certificates
Other domains with your brand in a valid certificate, on every plan, for a distinctive brand name; those with a sign-in word (login, secure, account) first: the usual set-up of a phishing site.
Pages impersonating you
With your own urlscan.io key: pages on other domains that load your files or carry your name, checked every day; new ones are alerted once.
Leaks and public footprint
What public archives and breach data already hold about your domain.
Archived backups
Addresses of backups, database dumps and configuration files the Internet Archive kept: they were public once, and may still hold passwords.
Public packages
npm packages whose links point to your domain, to check that none was published by mistake.
Secrets in public code
Every week, public files on GitHub that mention your domain, read for passwords, keys and tokens (AWS, Stripe, GitHub, private keys…); the secret is never kept, only its type, where it is and its first characters. New serious ones are alerted.
Breached addresses
With your own Have I Been Pwned key: how many addresses of your domain appear in known data breaches, and in which breaches (numbers only, never the addresses).
Exposure and reputation
What public data sets already say about your hosts.
Open ports
Databases, remote desktop and admin panels reachable from the internet, from Shodan’s public index.
Known vulnerabilities
CVEs on exposed services, prioritised with CISA’s list of exploited vulnerabilities and EPSS scores.
VPN gateways, firewalls and Exchange
Fortinet, Citrix, Ivanti, Palo Alto, SonicWall, Cisco, F5 and other edge devices, and on-premises Exchange, recognised on your addresses: the first target of attackers. Also directory (LDAP) and PPTP VPN ports, and hosts named like a remote access portal.
Newly exploited vulnerabilities
Every hour, the vulnerabilities seen on your addresses are compared with the exploited-vulnerability catalogs of CISA and the EU (ENISA, with EUVD identifiers): one that becomes exploited between two audits is flagged at once, and alerted from the Solo plan.
Blocklists
Domain and addresses on Spamhaus lists.
What we deliberately do not do
No port scanning from our servers (open ports come from Shodan's public index). No vulnerability exploitation. No password guessing. No crawling beyond the home page and a handful of well-known files such as robots.txt and security.txt. No requests to paths that could be sensitive unless you explicitly turn that option on for a domain you own. The result is an audit your hosting provider will never notice and your log files will record as a single visitor.
When you want the next step, a consent-based active scan of the applications you own is coming soon.