Scan any domain, free
See what a domain exposes in seconds.
The 18-check external dossier — DNS, email authentication, TLS, security headers, DNSSEC, and AI-crawler policy. Any domain, no signup, dated and re-runnable.
Scan a domain →External domain security posture
See what your domain exposes.
A free external scan of any domain's security posture — DNS, email authentication, TLS, security headers, and how it handles AI crawlers and agents. Verify one DNS record to run a deeper scan for exposed secrets and config. No signup for the free scan.
Free 18-check dossier on any domain. No signup.
For security teams & consultants
Scan your clients' domains, on a schedule.
Prove ownership with a DNS record and run the deep full scan for exposed secrets and config. Monitor every client domain, get a drift alert when something changes, and hand over a signed report with your name on it.
For security teams →The report
A signed report, not a dashboard.
Every finding carries the date it was observed. The paid report is Ed25519-signed, so whoever receives it — a client, an auditor, a customer’s security review — can confirm it hasn’t been altered since it was issued, without an account and without trusting us.
- Dated at the moment of observation
- Signed and independently verifiable
- Yours to hand a client or an auditor, offline, forever
How this compares to a one-off scanner.
Checking a domain's security usually means running a one-off scanner, trusting a self-attestation, or wiring up a monitoring tool. None of them gives you a dated, signed record — or looks past the surface for exposed secrets.
| SSL/DNS checker | Self-attestation | Monitoring tool | Domain Posture | |
|---|---|---|---|---|
| Checks from the outside, not self-reported | ||||
| Dated, so you can cite when it was true | ||||
| Adds a deep scan for exposed secrets, with DNS proof | ||||
| Re-checked on a schedule, with drift alerts | ||||
| Signed report you can hand a client or auditor |
One-off scanners check the surface and forget it. Domain Posture checks the whole external posture — and, once you prove you own the domain, the exposed secrets and config too — dated, re-run on a schedule, and signed.
Why external posture matters
Most of what an attacker or an auditor sees about a domain is checkable from the outside: how it authenticates email, whether TLS and DNS are set up right, which security headers it sets, and — increasingly — whether it has decided which AI crawlers and agents may read it. Most domains have never made that AI decision at all. Domain Posture checks all of it from the outside, on a schedule, and shows you exactly what's exposed.
We publish our own posture too, gaps included, on our trust page.
Monitor on a schedule
Know the day a domain's posture changes.
Subscribe and your domains — or every client domain you manage — are re-scanned on a schedule, with a drift alert the day something changes and a fresh signed report to hand over. Just checking one domain right now? Start with a single signed report from $29.
Signed or refunded within 30 days. Cancel anytime — every report you’ve received stays yours and verifiable forever.