Outside check

What can a stranger see?

Enter your web address. We read your domain’s public records, the same ones an attacker reads first, and score what we find.

Our email uses a different domain

Only check a domain you own or look after. What we look at and keep

The nine checks

  • Approved senders (SPF) · the mailbox
  • Signed mail (DKIM) · the mailbox
  • Spoofing policy (DMARC) · the mailbox
  • Mail provider · the mailbox
  • Website certificate · the front door
  • Forced HTTPS · the path in
  • Browser protections · the windows
  • Other public addresses · the side doors
  • Stolen logins · the key under the mat

Public sources only: DNS, your site’s certificate and response headers, certificate logs and an index of logins stolen by malware. Nothing is logged in to, probed or changed.

Drag to turn · click a part