How exposed is your domain?

Check nameservers, DNSSEC, email spoofing protection (SPF, DMARC, DKIM), certificate rules and forgotten subdomains. Read-only, public DNS data only. Nothing is changed on your systems.

Nameservers

Redundancy, consistency, open zone transfers and open resolvers.

DNSSEC

Whether your records are signed and the chain of trust is complete.

Email spoofing

SPF, DMARC and DKIM policies, plus MTA-STS and TLS reporting.

Certificates

CAA rules that limit which authorities may issue certificates for you.

Subdomains

Common names and Certificate Transparency logs, with takeover checks.

Wildcards

Records that make every made-up subdomain resolve.