Free tool Passive check
HTTPS, security headers, third-party scripts, email spoofing protection, DNS and registration, and publicly logged subdomains, checked in seconds, plus a place to read or build your SPF, DKIM and DMARC records. Every issue comes with the evidence and a fix you can copy.
This usually takes 5 to 15 seconds.
Mail records
The scan above reads what your domain publishes. Here you can take a single record apart in plain words, or answer a few questions and get records you can publish today.
dig +short TXT yourdomain.com, then look for the line starting v=spf1.dig +short TXT _dmarc.yourdomain.comdig +short TXT selector._domainkey.yourdomain.com, where the selector comes from the DKIM-Signature header of a message you sent.On Windows, nslookup -type=TXT yourdomain.com does the same job. Or run our domain checker, which finds all three for you.
Provider include values change. Check your provider's own documentation before you publish, and re-read the record here afterwards.
What we check
Certificate and TLS versions, HTTPS redirect, HSTS, Content-Security-Policy, clickjacking protection, cookie flags and security.txt, plus the third-party scripts your homepage loads, keys or source code exposed in its JavaScript, contact details bots can harvest, trackers without consent, and known vulnerable libraries.
Whether someone can send email that appears to come from you: SPF, DKIM and DMARC, which services are allowed to send as you, DKIM key strength, and MTA-STS and TLS reporting.
DNSSEC, CAA, the SaaS services your DNS verification records reveal, and your domain registration: registrar, expiry date and transfer lock.
Subdomains and recent certificates from public Certificate Transparency logs, other domains that share your certificates, mobile apps and public files like robots.txt and sitemap.xml, plus a map of everything connected to your domain.
Anyone can type any domain, so the tool only reads what a browser or a DNS lookup already sees. Testing a system for exploitable weaknesses needs the owner's authorization, which is what an assessment provides.
Each area starts at 100. A high-severity issue removes 25 points, medium 10 and low 3. Passes and informational notes cost nothing. The overall score weights website hardening 40%, email 35%, exposed surface 15% and DNS 10%, using only the areas that could be checked.
Data sources: public DNS (Cloudflare and Google resolvers), Certificate Transparency logs (crt.sh), domain registries via RDAP, OSV.dev and Retire.js for library advisories, secret patterns derived from gitleaks, and the Public Suffix List. No paid intelligence feeds.
A good grade is a good sign, not a certificate. This check cannot see application logic, access control, internal networks or source code. Read how access-control flaws hide from scanners.