Vendor security questionnaire
The DNS, email, and TLS questions on every security questionnaire — answered, dated, and kept current.
Domain Posture runs a live external security scan of your domain and turns the results into ready answers. Pre-fill them right here, copy them into your CAIQ, SIG, or custom response, and subscribe to keep them true between deals. Each answer is dated and signed, with the SOC 2 / ISO 27001 control it supports stamped beside it.
Fill answers from a domain scan
Enter your domain. We run the same 18 checks as a Domain Posture Domain Audit Report and pre-fill draft answers for 15 common vendor-questionnaire items. Copy, edit, and paste into your CAIQ / SIG / ISO 27001 response.
What the pack answers
Each question links to the wording for a Yes, a No, and a Partial, plus the SOC 2 / ISO 27001 control it evidences.
- Are the standard apex DNS records (A/AAAA/NS) published and resolving correctly?
- Does the domain publish valid MX records for inbound mail handling?
- Is SPF published with a hardfail (-all) policy on the sending domain?
- Does your domain enforce DMARC with a quarantine or reject policy?
- Are DKIM keys published with sufficient key strength (>= 1024 bits)?
- Is the public web endpoint protected by a valid TLS certificate from a trusted CA?
- Does the public web endpoint redirect HTTP to HTTPS within a single hop?
- Are HSTS, CSP, X-Frame-Options, and X-Content-Type-Options set on the public web endpoint?
- Does the public web endpoint avoid a permissive (wildcard) CORS configuration on credentialed responses?
- Has the public web surface (server identification, exposed paths) been reviewed?
- Is MTA-STS published to enforce TLS for inbound SMTP?
- Is TLS-RPT (SMTP TLS Reporting) published for failure visibility?
- Is DNSSEC enabled on the apex domain?
- Is the domain registration verifiable via WHOIS / RDAP with active status?
- Are TLS certificates monitored via Certificate Transparency logs for unauthorised issuance?
Scanning these for clients rather than for yourself? Get a free scan across five client domains — one report covering the whole portfolio, with your firm on the cover instead of ours.