How exposed is your domain? Find out in 30 seconds.

Common questions

Is the scan really free - what's the catch?

It's free and ungated: you enter a domain, you get the result on screen. No signup, no credit card, and I only get your email if you choose to have the report sent to you. The scan is how people find out whether they need me - that's the whole model.

What does the scan actually check?

Email authentication (SPF, DKIM, DMARC and whether your logo can appear in the inbox via BIMI), transport encryption (MTA-STS), and your SSL certificate. It checks only what's publicly visible from the outside - the same things an attacker or an insurer can see.

Does it catch an expired or 'Not Secure' SSL certificate?

Yes - the scan checks your SSL certificate's validity, trust chain and expiry, the same signals a browser uses to decide whether to show a padlock or a 'Not Secure' warning. This is where the standalone SSL checker moved to - same check, one page.

My domain got a bad grade - how urgent is it?

A failing DMARC or SPF result means anyone can send email that looks like it came from your business right now - that's how fake-invoice scams reach your customers. It's usually a fixed-price, same-week fix, not a project.

What's the difference between this and the paid Security Deep-Dive Audit?

This scan covers what's visible from outside. The Deep-Dive Audit ($290) goes inside: your Microsoft 365 or Google Workspace settings, MFA coverage, and a prioritised fix list. It's the thorough version of what you just ran.