DNS Security

LivePhase 1 · Know your domain

Is the zone configured safely?

50 checks for subdomain takeover, DNSSEC, email authentication records, nameserver hygiene and DNS exposure. Start here.

What it checks

SPF, DKIM and DMARC records
DNSSEC signing and chain
CAA issuance policy
Subdomain takeover on dangling records
MX, NS and wildcard hygiene
Zone exposure and AXFR

Start here

Runs in your browser. Nothing is uploaded, no account.

Open DNS Security

02

DMARC Reports

LivePhase 1 · Know your domain

Is your sending reputation safe?

Who actually sends as your domain, whether it authenticates, and whether the failures are going away — read from the reports providers already send you.

What it checks

Who actually sends as your domain
SPF and DKIM pass rates per source
Alignment failures and their cause
Sending sources you never authorised
Whether failures are shrinking or growing
Per-provider report coverage

Start here

Runs in your browser. Nothing is uploaded, no account.

Open DMARC Reports

03

Public IP & Ports

plannedPhase 2 · Close what is exposed

What is exposed to the internet?

Open ports, service versions and admin surfaces on the addresses you publish.

What it checks

Open ports and what answers
Service banners and versions
Exposed admin interfaces
TLS on non-web services
Known-bad IP reputation
Reverse DNS consistency

Status

Not built yet. It ships as a browser check with the same guarantee: nothing uploaded, no account.

04

Edge & WAF

plannedPhase 2 · Close what is exposed

Is the front door defended?

TLS, security headers and WAF rules in front of the load balancer.

What it checks

TLS versions and cipher suites
Certificate chain and expiry
HSTS and security headers
Cookie flags and CORS policy
WAF rule coverage
Origin reachable past the WAF

Status

Not built yet. It ships as a browser check with the same guarantee: nothing uploaded, no account.

05

Application Security

plannedPhase 3 · Secure the application

Is the code and its supply chain clean?

SBOM and dependency tracking, secrets scanning, SAST and DAST — per language stack, with the tooling to run them.

What it checks

Secrets in code and history
SAST on every pull request
Dependency vulnerabilities
SBOM generated and tracked
Container and base image CVEs
DAST and API probing

Status

Not built yet. It ships as a browser check with the same guarantee: nothing uploaded, no account.

The twelve layers, and where each runs

SecretsEvery push

Keys and tokens committed, now or in history

SASTEvery pull request

Insecure patterns in the source you wrote

SCAEvery push

Known vulnerabilities in your dependencies

SBOMEvery build

What is actually in the build, tracked over time

LicencesEvery pull request

Dependency obligations nobody read

ContainerEvery build

Base image and OS package CVEs

IaCEvery pull request

Terraform, Kubernetes and CI misconfiguration

DASTEvery deploy

A running application probed from outside

APIEvery deploy

Schema drift, authorisation and injection on endpoints

FuzzingScheduled

Inputs nobody wrote a test for

Supply chainEvery release

Signed, attested build artefacts

Secure codingEvery pull request

Language-level lint and standards

StacksGoNode.jsPythonJavaC#PHPRubyRust

06

VAPT & OWASP

plannedPhase 3 · Secure the application

Does it hold up to an attacker and to the standard?

Penetration-test checklists and OWASP validation, with the evidence each one produces.

What it checks

OWASP Top 10 mapped to findings
Authentication and authorisation tests
Injection and input handling
Penetration test checklists
Re-test after remediation
Evidence per finding

Status

Not built yet. It ships as a browser check with the same guarantee: nothing uploaded, no account.

07

Compliance

plannedPhase 4 · Prove it

Can you prove it?

Not a scan — the evidence the stages above produce, mapped to the framework you answer to.

What it checks

Controls mapped to your framework
Evidence collected from each phase
Gaps and owners tracked
Change history for auditors
Audit-ready export

Status

Not built yet. It ships as a browser check with the same guarantee: nothing uploaded, no account.

Security checks for the whole stack

DNS Security

What it checks

Start here

DMARC Reports

What it checks

Start here

Public IP & Ports

What it checks

Status

Edge & WAF

What it checks

Status

Application Security

What it checks

Status

The twelve layers, and where each runs

VAPT & OWASP

What it checks

Status

Compliance

What it checks

Status

How it runs

In your browser

DNS over HTTPS

Reputation, not a score