Is your domain set up safely? Know within 24 hours, for $10
Domain Security Check tests your domain's registration, DNS, email authentication, certificates, web security headers and forgotten subdomains in one pass. You prove the domain is yours, we run the check within 24 hours, and the full report arrives by email with exact fixes your AI agent or IT person can apply.
Updated
- Ownership is verified first, with a DNS TXT record or a file on your site, so only the domain's owner can order the check and receive the results.
- Covers registration and DNSSEC, SPF, DKIM, DMARC and MTA-STS, TLS and HSTS, security headers, exposed services and dangling subdomains.
- One report in two layers: a plain-language summary for you and a fix brief with exact records and config lines for your AI agent or IT.
In a study of 67,336 company domains observed April to July 2026, 45.1% had no DMARC record and only 16.3% were at p=reject.
Source: ciphercue.comCSC reviewed over 440,000 DNS records and found that over 21% pointed to content that does not resolve, the condition behind subdomain hijacking (April 2023).
Source: itweb.africaAn internet-wide scan of about 220 million hosts found 424,120 subdomains with misconfigured CNAME records that were open to takeover.
Source: redhuntlabs.comYour domain runs your email, logins and website, and nobody has looked at it in years
A domain is more than a website address. It is where your email is delivered from, where password resets are sent, and what customers check before they trust a link. The settings that protect it are spread across a registrar, a DNS host, a mail provider and a web host, usually configured once, years ago, by different people. Nobody looks again until something breaks: an expired certificate, invoices landing in spam, or an old subdomain suddenly serving someone else's page.
The gaps are common. In a 2026 study of more than 67,000 company domains, almost half had no DMARC record at all, so anyone can send mail that claims to come from them. Old DNS records that still point at deleted cloud services are a known route to subdomain takeover, and newer protections such as MTA-STS are still rare even among the busiest domains.
Free checkers each test one layer and hand back a grade. Domain Security Check runs the whole set against your domain once, for $10, and sends a single report written so the person or AI agent who manages your domain can apply each fix without a meeting.
Without it
- Free single-purpose checkers (SSL Labs, securityheaders.com, Mozilla HTTP Observatory, internet.nl, MXToolbox): Good, free, and worth running. Each covers one layer, such as TLS, headers or mail DNS, and returns a grade. You still…
- Pay-per-scan vulnerability scanners: CyStack's Quick scan, for example, is $9 per scan for one asset, and its Deep scan is $65 a month for five assets.…
- Attack surface platforms and penetration tests: The right choice for security teams and regulated products, typically sold as annual contracts or priced in the…
With Domain Security Check
- Ownership is verified first, with a DNS TXT record or a file on your site, so only the domain's owner can order the check and receive the results.
- Covers registration and DNSSEC, SPF, DKIM, DMARC and MTA-STS, TLS and HSTS, security headers, exposed services and dangling subdomains.
- One report in two layers: a plain-language summary for you and a fix brief with exact records and config lines for your AI agent or IT.
- Registration and DNS
- Email authentication
How it works
- 1
Request the check
Enter the domain and the email address that should receive the report. Requesting takes about a minute.
- 2
Prove the domain is yours
We email you a unique verification code. Add it as a TXT record at your DNS host, or upload it as a file on your website. It takes about five minutes, and nothing is tested before it is in place.
- 3
We run the check within 24 hours
Registration, DNS, email authentication, mail server TLS, certificates, web security headers, exposed services and every subdomain we can find, all tested from the outside without touching your data.
- 4
The report arrives by email
A plain-language summary ranked by risk, plus a fix brief with the exact records, settings and commands for your AI agent or IT person, and a way to confirm each fix worked.
Features
Registration and DNS
Expiry date, registrar transfer lock, nameserver redundancy, DNSSEC signing, CAA records that limit who can issue your certificates, and whether your DNS hands out its full zone to anyone who asks.
Email authentication
SPF syntax and the 10-lookup limit, DKIM on common selectors, DMARC policy and reporting, MTA-STS and TLS reporting, and whether your mail servers offer STARTTLS with a valid certificate.
Forgotten subdomains
Subdomains found in public certificate transparency logs and DNS, each checked for records that still point at deleted cloud services, apps or storage, the setup attackers use for subdomain takeover.
Certificates and HTTPS
Certificate validity, chain and expiry on the domain and its subdomains, old protocol versions such as TLS 1.0 and 1.1, HTTP to HTTPS redirects and HSTS.
Web security headers
Content-Security-Policy, framing protection, X-Content-Type-Options, Referrer-Policy, cookie flags and a security.txt contact, with the header lines to add for your server or CDN.
Exposed services and files
Common ports open on the domain's hosts, such as remote desktop, databases and admin panels, and publicly reachable files like .git folders or .env files. Run only after ownership is verified.
Blocklists and lookalike domains
Your mail servers and domain checked against major blocklists, plus registered lookalike domains (typos and other endings) that could be used to phish your customers.
A fix brief for your agent or IT
Every finding with severity, evidence, why it matters, the exact fix and a command to confirm it, as Markdown and JSON you can paste into Claude, ChatGPT, Copilot or Cursor, or forward to IT.
A look inside
What you get: the working view and the delivery report.
Illustration of the layout, built from this page's own feature list. It shows no real results.
Who it's for
Small businesses without an IT team
You have a domain, a website and email, set up by someone who has since moved on. You get a clear answer on what is safe, what is not, and a report you can forward to whoever fixes it.
Founders selling to bigger customers
Security questionnaires ask about SPF, DMARC, TLS and subdomain hygiene. A dated report and a list of closed findings make those answers short and true.
Freelancers, agencies and MSPs taking over a domain
Run a baseline check when a client hands you their DNS, so you know what you inherited before anything breaks on your watch. Whoever controls the DNS can complete the verification.
Teams that run their stack with AI agents
The fix brief is written for Claude Code, ChatGPT, Copilot or Cursor: exact record values and config snippets, so the agent drafts the changes and a person reviews them before they go live.
Works with
- Any DNS host: Cloudflare, GoDaddy, Namecheap, Route 53, Google Cloud DNS, Squarespace, Wix
- Microsoft 365 and Google Workspace mail
- RDAP and WHOIS registration data
- Certificate transparency logs
- Major DNS blocklists
- Fix snippets for Nginx, Apache, IIS and Cloudflare
- Markdown and JSON fix brief for Claude, ChatGPT, Copilot and Cursor
- PDF report by email
Pricing
$10 once per domain, including the subdomains we find for it. No subscription. Ownership must be verified before the check runs; if it can't be verified, or the report isn't delivered within 24 hours of verification, you are refunded in full. Founding customer price for early-access orders.
Orders are subject to the Domain Security Check terms.
Domain security check
$10 one-time per domain
One domain and every subdomain we find for it
- Ownership verified by DNS TXT record or file
- Registration, DNS, DNSSEC and CAA checks
- SPF, DKIM, DMARC, MTA-STS and mail TLS
- Certificates, HTTPS, HSTS and security headers
- Subdomain takeover, exposed services and files
- Blocklist and lookalike domain check
- Report by email within 24 hours of verification
- Fix brief for your AI agent or IT (Markdown and JSON)
Compared with the alternatives
- Free single-purpose checkers (SSL Labs, securityheaders.com, Mozilla HTTP Observatory, internet.nl, MXToolbox)
- Good, free, and worth running. Each covers one layer, such as TLS, headers or mail DNS, and returns a grade. You still have to run them all, cover the subdomains, and turn the grades into fixes yourself.
- Pay-per-scan vulnerability scanners
- CyStack's Quick scan, for example, is $9 per scan for one asset, and its Deep scan is $65 a month for five assets. These look at a website or server; Domain Security Check also covers registration, DNS, email authentication and the subdomains around it.
- Attack surface platforms and penetration tests
- The right choice for security teams and regulated products, typically sold as annual contracts or priced in the thousands. More than a small business needs to find out whether its domain basics are right.
- Asking your IT person or agency to look
- Often the best person to fix things, but a full review takes hours they may not have. Send them the report instead: the findings, evidence and exact fixes are already written down.
What changed
- In a study of 67,336 company domains observed April to July 2026, 45.1% had no DMARC record and only 16.3% were at p=reject. Source: ciphercue.com
- CSC reviewed over 440,000 DNS records and found that over 21% pointed to content that does not resolve, the condition behind subdomain hijacking (April 2023). Source: itweb.africa
- An internet-wide scan of about 220 million hosts found 424,120 subdomains with misconfigured CNAME records that were open to takeover. Source: redhuntlabs.com
- In the first week of 2026, only 7,377 of the top 1 million domains (0.7%) published an MTA-STS policy, which protects mail in transit from downgrade attacks. Source: uriports.com
From request to report
Adding the verification code takes about five minutes. The check runs and the report reaches your inbox within 24 hours of verification.
- Day 1: Request the check; your verification code follows by email within one business day.
- Same day: Add the code as a TXT record or upload it as a file, then reply to let us know.
- Within 24 hours of verification: The check runs and the report and fix brief arrive by email.
- After the report: Remove the code, then apply the fixes yourself, with your AI agent or with IT.
Security and data
- We test only domains whose ownership has been verified by DNS TXT record or file, and only within that domain and its subdomains.
- The report is sent only to the email address on the request and is never published or shared.
- Tests are non-destructive and low-volume: no password guessing, no exploits, no load testing, and we never read your data or mailboxes.
- We never ask for registrar, DNS, hosting or email passwords.
- Scan results are deleted 30 days after delivery, or earlier on request.
Questions
Why do I have to prove that I own the domain?
Some checks touch your servers directly, such as open-port and exposed-file tests, and the report describes weaknesses an attacker would want to know about. We run them only with the owner's authorization and send the results only to the owner, so we verify control of the domain first.
How do I prove ownership?
After you request the check, we email you a unique code. Either add it as a TXT record (rotomal-verify=your-code) at your DNS host, or upload it as a file at /.well-known/rotomal-verify.txt on your website. DNS changes usually show up within minutes but can take longer at some hosts. You can remove the record once the report arrives.
What exactly is in the report?
A one-page summary of what is safe and what is not, ranked by risk, followed by every finding with its evidence, why it matters, the exact fix and a command to confirm the fix worked. The fix brief comes as a PDF plus Markdown and JSON, so you can forward it to IT or paste it into an AI agent.
Can I give the report to my AI agent?
Yes, that is what the Markdown and JSON fix brief is for. Paste it into Claude, ChatGPT, Copilot or Cursor and the agent can draft the DNS records and config changes. Review every change before it goes live, and never give an agent your registrar or DNS password; let it prepare the change and apply it yourself.
Will the check affect my website or email?
No. The tests are low-volume and non-destructive: no password guessing, no exploits, no load testing, and no mail sent to your users. Most checks read public DNS and certificate data, and the few that connect to your servers do so the way an ordinary visitor or mail server would.
Is this a penetration test or a compliance certificate?
No. It is a fixed-scope check of domain, DNS, email, certificate and web configuration plus exposed services. It does not test your application's logic and does not certify compliance with ISO 27001, SOC 2, PCI DSS or GDPR; it is not legal or compliance advice.
Which domains can I check, and what counts as one?
Any domain you control, wherever it is registered and hosted. One check covers one registered domain, such as example.com, and every subdomain we find for it. A second domain, such as example.co.uk, is a second $10 check.
When does the 24 hours start?
When we confirm your verification code is in place. If the report hasn't reached your inbox within 24 hours of that, you get your $10 back.
Check your domain before someone else does
Request the check, prove the domain is yours, and the report reaches your inbox within 24 hours of verification. $10, once.
Request service