What does your company’s domain expose?
Enter your domain and we check live, from your browser, what anyone can see about your email and DNS, with a traffic light and what it means for your business. It is a passive review of public information, not a penetration test.
Passive review of your company’s domain
What this review cannot see
A browser can only read public DNS information and check whether a site answers. Anything else needs a review with you, and we do not fake it here.
- Site security headers (HSTS, CSP, X-Frame-Options…): the browser does not allow reading them from another domain.
- Certificate details (expiry, issuer, TLS version).
- Open ports and services: we do not run port scans.
- Forgotten subdomains and their state.
- Whether your passwords or emails appear in known breaches.
- Software versions and vulnerabilities on your servers or site.
- Whether DKIM selectors other than the common ones we try exist, and the contents of the MTA-STS policy file.
- Everything internal: devices, access, backups, how the team is trained.
What we check
- SPF: whether it exists, how it ends (-all or ~all) and whether it stays within the 10 DNS lookup limit.
- DMARC: whether it exists and which policy applies (observe, quarantine or reject).
- DKIM: whether there is a signature at the most common selector names.
- MX: who receives your email.
- CAA: who may issue certificates for your domain.
- DNSSEC: whether DNS answers for your domain are signed.
- MTA-STS and TLS-RPT: whether encryption is required for email arriving at your domain.
- HTTPS: whether your site answers with a certificate the browser accepts.
How we calculate this
- Everything is queried from your browser, with DNS over HTTPS: first to Cloudflare (1.1.1.1) and, if it does not answer, to Google (8.8.8.8). These are public queries, the same ones any mail server would make.
- Traffic light: green, the point is fine; amber, improvable; red, worth attending soon; grey (“info”), it cannot be judged or is informational. Color never stands alone: every result carries its label.
- SPF and DMARC weigh more because they decide whether someone can spoof your email. An overall red needs at least one red point; amber, an amber point in SPF, DMARC, DKIM or HTTPS, or both CAA and DNSSEC improvable; otherwise green.
- DKIM is searched only at the most common selector names. If it does not appear we mark it “not verifiable”, never “missing”: each provider uses its own name and there is no public way to list them.
- HTTPS: we try to open your site. If the browser succeeds, the certificate is valid and current; we cannot see headers such as HSTS or certificate details. If it fails, we mark it improvable because there are many possible causes.
- DNSSEC and CAA are queried on the estimated main domain (for example, company.com.mx), with a simple rule because we do not use the public suffix list. If your domain is unusual, those two points may not correspond.
We tell you plainly what a browser cannot see. That is what the call is for: we go over it with you, with your authorization and the right tools.
Results are as of the review date: DNS changes. If you fix something, check again.
Let’s go over your result together.
In thirty minutes we review each point, tell you which ones matter for your operation and what remains to be looked at from the inside.
Let us listen.
We will find the areas of opportunity and propose better processes, automations or custom-built solutions. Thirty minutes, no sales deck: you leave with a concrete read on your operation, whether or not you work with us. And if we are not the right firm, we will tell you right there.
Thirty minutes, at a time that suits you.
Within one business day.