The signed report
18 checks across the apex plus up to 100 CT-discovered subdomains — DNS, email authentication, TLS, security headers, DNSSEC, and AI-crawler policy — delivered as a signed PDF + JSON sidecar, Ed25519-signed and ISO-timestamped. In your inbox in 10–30 minutes.
Each finding also maps to the SOC 2 / ISO 27001 / NIST control it evidences, and the same report is the fastest way to evidence an AI-vendor review — signed and independently verifiable.
If your report doesn't verify against our public key, or it isn't accepted where you needed it, reply to the delivery email within 30 days for a full refund. You keep the report.
Real samples: stripe.com · vercel.com · github.com — same engine as the free dossier you can run right now.
Questionnaire due this week? Signed answers land in your inbox before your next stand-up.
manifest.json) — SHA-256 plus Ed25519 signatureDomain Audit Report · one-shot
$29/ report
One signed report for one apex plus up to 100 CT-discovered subdomains — the same evidence a consultant bills $500+ in hours to assemble by hand. Delivered in 10–30 min by email. The artifact is valid forever — re-run only when you want fresh evidence.
Get the report →No subscription. No account required to receive the artifact.
If your report doesn't verify against our public key, or it isn't accepted where you needed it, reply to the delivery email within 30 days for a full refund. You keep the report.
Stay questionnaire-ready · Starter
$49 / month
The one-shot report answers today’s questionnaire; Starter keeps you ready for the next one — up to 3 root domains re-scanned on your schedule, a fresh signed report every run ready to attach, and a drift alert the day an answer regresses (TLS expiry, SPF change, DMARC weakening). Less than two one-shot reports a month.
See subscriptions →Every finding cites the standard it references. Read the full methodology document at /methodology/v1.
Every pack is signed with our Ed25519 key. Verify offline against the public key.
curl -O https://domainposture.com/sample/pack.pdf curl -O https://domainposture.com/sample/manifest.json curl -O https://domainposture.com/sample/manifest.sig curl -O https://domainposture.com/.well-known/evidence-pack-pubkey.pem openssl pkeyutl -verify -pubin -inkey evidence-pack-pubkey.pem \ -rawin -in manifest.json -sigfile <(base64 -d manifest.sig) jq -r '.artifacts.pdf.sha256' manifest.json shasum -a 256 pack.pdf
what this is not
the Domain Audit Report is supporting technical evidence for public-facing domain controls. it is not a SOC 2 audit report and does not replace an auditor; it gives them less to chase. it is not a penetration test, not a risk register, and not a substitute for compliance tooling like Vanta, Drata, or SecureFrame — those tools manage the audit programme; the pack documents the public domain surface they reference.