Email authentication
MX hosts and redundancy, SPF policy, DMARC enforcement, MTA-STS.
SOC 2 CC6.6SOC 2 CC6.7SOC 2 A1.2ISO A.5.14ISO A.8.14ISO A.8.20
Check your domain's external security posture
See what an attacker sees first: mail records, DNS, HTTPS, browser defences and forgotten subdomains, graded A to F and mapped to the SOC 2 and ISO 27001 controls each one affects.
Passive checks on public records only. No sign-up. Results in about ten seconds.
What the scan checks
Five areas of passive checks, each mapped to the SOC 2 Trust Services Criteria and ISO 27001:2022 Annex A controls it gives evidence for.
DNS hygiene
Nameserver redundancy, CAA records restricting certificate issuance, DNSSEC signing.
SOC 2 CC6.6SOC 2 A1.2ISO A.8.14ISO A.8.20
TLS and HTTPS
HTTPS reachability, HTTP to HTTPS redirect, HSTS policy strength.
SOC 2 CC6.1SOC 2 CC6.7ISO A.8.24ISO A.8.20
HTTP security headers
Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
SOC 2 CC6.1SOC 2 CC7.1ISO A.8.9ISO A.8.27
Subdomain footprint
Subdomain enumeration from Certificate Transparency, flagging staging and legacy hosts.
SOC 2 CC6.1SOC 2 CC7.1ISO A.5.9ISO A.8.8
From scan to audit evidence
Every control chip opens the control text, suggested evidence and Trust Services Category in the Compliance Framework Explorer. Free, no sign-up.
Open the Framework ExplorerEvery check is passive and based on publicly observable data. Nothing is sent to non-public endpoints and nothing on your systems is changed. A scan usually completes in under ten seconds.