Toolkit
Domain Security Check
See what an attacker sees before they try anything. This checks whether someone can send email pretending to be you, and whether your site sets the headers that stop the common browser-side attacks. It takes about ten seconds and asks for nothing.
Reads public DNS records and response headers only. No login, no scanning, nothing intrusive — the same information any mail server sees.
What this checks, and what it doesn't
It checks
- SPF — who may send email as your domain
- DKIM — whether your mail is cryptographically signed
- DMARC — what happens to mail that fails those checks
- MTA-STS and DNSSEC
- HSTS, CSP and the other security response headers
- Whether your software versions are advertised publicly
It cannot see
- Endpoint and server patching
- Identity and access configuration, MFA coverage
- Backup integrity and restore testing
- Whether your staff would spot a phish
- Anything behind a login
That second list is where most incidents actually begin. A clean result here is a good sign, not an all-clear.