Check your company's mail, domain and website in a minute
We show whether someone can send email in the name of your company, whether look-alike domains of yours exist and what to fix first. No sign-up, public data only.
Grade D, critical issues: 3
A fictional company with no DMARC and a DNS record left over from an old shop. Points alone would give grade C; critical issues lower it to D.
- Email spoofingpossible: no DMARC
- SPF: sender listcorrect
- DKIM: message signatureworking
- Typo domains1 registered
- Forgotten subdomains1 can be taken over
- Website certificatevalid
- Security headers2 of 6 missing
- Domain expiry2027-03-14
- 69checks in 8 areas
- about 1 minfrom typing the domain to the result
- Freeresult with priorities and details
- 0 cookieson public pages
What we check
Only what anyone can see from the internet: no login, no access to your server and no port scanning. 6 areas count toward the security grade; Google visibility and accessibility are shown separately. Full list of checks with weights.
Spoofing your company
One verdict from SPF, DKIM and DMARC: can someone send an email "from your company" to your customers. This is the mechanism behind fake invoice fraud.
Look-alike domains
Names with a typo or an extra word (cornpany.com, company-shop.com) that someone could use to impersonate you. We show which ones already exist and have mail.
Forgotten subdomains
From public certificate logs we read addresses like dev., test., old-shop. and check whether any of them points to a service that can be taken over.
Secrets in page code
API keys, tokens and passwords that ended up in the page code by mistake and that anyone can read.
MX, SPF, DKIM, DMARC, MTA-STS, encryption and the mail server certificate. This usually explains why messages land in spam.
Website and domain
HTTPS and certificate, old TLS versions, security headers, cookies, CMS version, DNSSEC, CAA, domain expiry date.
What you get
One page that a business owner can understand and hand to an IT person or a mail provider.
- A grade from A to E and a score of 0-100, separately for each area.
- Up to three top fixes with an explanation of the risk to the company and how to repair it.
- What an attacker sees when looking at your domain from outside.
- Details of every check, including the ones that passed.
Grading scale
- A
- 90-100 no serious remarks
- B
- 80-89 minor fixes
- C
- 65-79 room to improve
- D
- 50-64 serious gaps
- E
- below 50 urgent
One critical issue, for example a missing DMARC, lowers the grade to D at best. Checks that could not be performed do not count toward the score.
How it works
No account and nothing to install. You see the result right in the browser.
- 01
Enter a domain
The company domain, not an email address. You confirm that it is your company or that you have the owner's permission.
- 02
The scan takes about a minute
DNS queries, public certificate logs, a few visits to the website and one connection to the mail server.
- 03
You get a result with priorities
A grade from A to E, what it means for the company and what to fix first. After the fixes you run the scan again.
Who is behind it and how to verify it
Auditor is a tool by SecVault, a Polish company that hardens and monitors company infrastructure. The scanner is our own software and runs on our server in the European Union. Contact: [email protected], abuse reports: [email protected].
Before you enter a domain
Six short answers. If your question is missing, write to [email protected].
Can a scan harm my website or mail?
No. A scan is DNS queries, up to 25 requests to the website (like an ordinary visitor) and one connection to the mail server without sending any message. We do not scan ports, do not try to log in and change nothing.
Is it really free?
Yes. The result with the grade, priorities and details of every check is free and needs no account.
What do you store?
The domain name and the scan result for 90 days. Instead of an IP address we store a hash that changes daily. Your email address only if you give it. Details are in the privacy policy.
Who will see my result?
Only the person who has the link. The result has a random address, is not indexed by search engines and we do not publish a list of scanned domains.
I got a D, yet my website and mail work. Why?
The grade does not measure whether services work, but how easy they are to abuse: spoofing your mail, taking over a forgotten subdomain, eavesdropping on a connection. One critical issue, for example a missing DMARC, lowers the grade to D at best.
Can I check someone else's domain?
The scan reads public data only, but we ask you to check your own company or domains you have permission for. A domain owner can exclude the domain from the auditor; the instructions are on the about the robot page.
Check your domain
One minute, no sign-up. The result stays with you.