Domain security posture monitoring
Your own domains can be the easiest way in: email that can be faked, certificates about to expire, subdomains nobody remembers. We check each one daily, grade it A to F and show your team what to fix.
The daily check is part of Pro and Enterprise. A demo takes 30 minutes, which is enough for us to give you a clear annual price for your domains.
- 40+ tests on each domain in every check
- 5 areas, each with its own score and grade
- Daily checks, plus a rescan whenever you want one
- 0 agents to install or DNS changes to make
What attackers look for first
Attackers use automated tools to look for easy openings: an exposed .env file, a DMARC policy that lets fake email through, a forgotten subdomain. This check looks for the same things every day, so you can fix them first.
The scorecard shows a grade for the domain, a grade for each of the five areas, and how many points the other names you own took off. Below it, each finding with its fix.
- Fix what attackers look for first
- Exposed files, email that can be faked, subdomains someone could take over, and certificates about to expire.
- See your domains from outside
- Everything you publish, checked the way an outsider sees it, including subdomains and lookalikes you registered yourself and forgot about.
- One grade per domain
- A to F, with the findings behind it underneath.
One scorecard, five areas
A check runs more than 40 tests across five areas. Together, the five area scores make the domain’s grade.
Email security
- DMARC policy, including p=none, subdomain policy and partial enforcement
- SPF senders and how the record ends
- DKIM signing keys
- MTA-STS, TLS-RPT and BIMI
- Null MX on domains that should not receive email
Domain & DNS
- Subdomain takeover (dangling CNAME)
- DNSSEC, CAA and wildcard records
- Domain expiry and registrar lock
- Dangling NS delegation
TLS / SSL
- Certificate validity, chain and hostname match
- Early warning before a certificate expires
- HSTS enforcement
- Old protocols and weak ciphers
Web hardening
- Security headers (CSP, X-Frame-Options, nosniff…)
- Secure cookie flags
- security.txt and SRI
- COOP / COEP / CORP isolation
Exposure
- Exposed files (.env, .git/, backups, configs)
- Information disclosure (banners, stack traces, directory listing)
- Secrets in served JavaScript (only a redacted fingerprint is kept)
Unused domains are graded too
A registered but unused domain is the easiest to fake email from, because sending email needs no mail server of its own. Each domain is graded for the job it actually does.
Domains that send email: graded on whether SPF, DKIM and DMARC are set up correctly and enforced.
Parked or defensive domains: graded on whether they are locked down so nobody can send email as them.
How a check works
Add a domain to your account and the scanner picks it up automatically, covering all five areas in one pass.
Step 1
Find what you own
When you add a domain, we read the public certificate logs to find its subdomains. Forgotten ones are checked too.
Step 2
Check from outside
DNS lookups, a normal connection to read each certificate, and ordinary page requests, including a short list of commonly exposed files such as .env or backups. Requests are paced so they do not look like an attack to your firewall.
Step 3
Score and grade
Findings roll up into five area scores and a 0–100 overall score, shown as a grade from A to F.
Step 4
Track and re-check
Checks run daily. Fix something and the finding closes; if it comes back, it reopens. You can run a check whenever you want.
A written fix for each finding
Each finding comes with the steps to fix that exact issue. For example:
DMARC policy is p=none
Mail servers are not told to block email that fakes your domain, so many deliver it. Once your real senders pass SPF or DKIM, change your DMARC record to:
v=DMARC1; p=reject; rua=mailto:reports@yourcompany.com
Check your senders first: if your newsletter or invoicing tool is not set up to pass, its email will be rejected too.
What to fix
yourcompany.com
- OpenFixed
Email can be forged from your domain
Email security
- OpenFixed
Old subdomain could be claimed
Domain & DNS
- OpenFixed
Certificate expires in 9 days
TLS / SSL
- Reopened
Missing secure-connection setting
Web hardening, came back after a site update
- Steps to fix the exact issue, shown next to the finding.
- Findings move from open to acknowledged to fixed, and the history is kept for each domain.
- For exposed secrets we keep only a salted fingerprint and a redacted preview, never the secret itself.
Also worth knowing
- Subdomains found for you
- Found in the public certificate logs when you add a domain, and kept up to date as new certificates appear. Each one is checked for takeover risk, DMARC coverage and certificate health.
- Brand surface
- A separate card on the scorecard covers the other names you own: lookalikes you registered yourself, and your subdomains. If one of those could send fake email or be taken over, it takes points off the overall grade. The deduction is capped, so these alone never pull a sound domain down to an F.
- Built on the same platform
- The same list of domains, the same Security Center and the same company reporting as Layers 1 to 4. No agent to install and no DNS change to make.
Results show on your scorecard; they do not raise alerts the way lookalike threats do. The check reads your published records, not your DMARC reports.
See the daily check on your own domains
The daily check of your own domains is part of Pro and Enterprise. The free scan does not grade them.
A demo takes 30 minutes, enough for us to give you a clear annual price. The free scan checks 150+ lookalikes of your domain, not your own domain's set-up. See all of prevention