95 checks. Each one is a problem you stay ahead of.
From a certificate that expires silently to mail sent in your name: below you see, area by area, what we examine and why it matters to you. Everything is measured from the outside, without access to your systems. 28 checks are free, for all your domains.
| Area | Lite | Extended | Ultra |
|---|---|---|---|
| Registration | 6 | 13 | 13 |
| DNS | 8 | 25 | 26 |
| 7 | 23 | 26 | |
| Website and TLS | 5 | 18 | 20 |
| Reputation | 2 | 9 | 10 |
| Total | 28 | 88 | 95 |
- Eleven of the 95 checks are informational: they run and appear in the report, but do not count towards the score.
- What is not measurable for your domain or extension is shown separately and costs you no points.
Registration
Can someone take over my domain?Everything around the registration itself: is the domain protected against unwanted transfer, is the DNSSEC linkage correct, and is it not quietly expiring.
- Registry status and locks against transfer
- Expiry date and renewal, where the registry releases it
- DNSSEC linkage (DS record) at the registry
- Registrar and abuse contact points
DNS
Do I stay reachable if one provider goes down?Your name servers are your domain's address book. If they all sit in one place, or are misconfigured, everything is unreachable: website and mail.
- Number of name servers and spread across networks and countries
- DNSSEC: signing and validity of the chain
- Zone transfers open to anyone
- Consistency between the name servers
- IPv6 reachability and wrong or stale records
The most abused weakness at SMEs: mail that appears to come from you. We read your domain's intent (receiving, sending only, or neither) and test accordingly.
- SPF: who may send, and is the policy strict enough
- DKIM: are your messages signed
- DMARC: what happens to forged mail, and do you get reports
- MTA-STS and TLS-RPT: enforcing encryption of mail in transit
- Mail servers: reachability, encryption and certificates
Website and TLS
Will my customer see a warning soon?Your website's certificate and encryption, and the security settings a browser expects from your server.
- Certificate: validity, expiry, chain and name
- Encryption versions and, on Ultra, the cipher policy
- Redirect from http to https and HSTS
- Security headers and cookie settings
- Admin interfaces reachable from the internet
Reputation
What does the internet know about me that I don't?What others have already established about your domain, and what public logs say about you.
- Blocklists and reputation sources for the domain and mail servers
- Certificates in public logs, including ones you do not know
- Subdomains mapped, forgotten or orphaned ones included (Ultra)
- Network: who holds the address space and whether it is correctly published
- Abuse contact points (security.txt)
What a finding looks like
Your domain can be used to forge mail
Someone can send an invoice today that looks like it comes from your address. Your customer sees no difference, and the complaint lands with you.
Your DMARC policy is set to p=none. Recipients are therefore free to deliver forged mail as normal.
v=DMARC1; p=none; rua=mailto:Move the policy to quarantine, and then to reject once you are sure all your sending services sign their messages.
Standard: RFC 7489 (DMARC)Illustration. In your report this covers your own domain, with the value we actually measured.
Know where you stand within a minute
A free account, your domains added, and the 28 free checks run right away. Upgrading can wait, per domain.
Create a free account