Check your public email and website security settings
Nine read-only checks against what anyone on the internet can already see about your domain. Results in seconds, no email address needed.
Passive and read-only: public DNS and the response your website gives any visitor. Nothing is probed or logged into, and no email address is needed.
Quick answer
This check reads nine public settings for any business domain: SPF, DKIM and DMARC (who can send email as you), MTA-STS and TLS reporting (whether email to you travels encrypted), and the website's HTTPS redirect, certificate, HSTS and clickjacking protection. It uses public DNS, the response your website gives any visitor and the certificate it presents. It does not port-scan, test or log into anything, so it cannot see internal systems or services - those are covered by the deeper external-exposure review.
What happens next
Run the check
Enter your domain. Each of the nine settings is read live and explained in a sentence.
Fix the quick wins
Most gaps here are DNS records or web server headers. DMARC set to p=none is the most common and the one behind most invoice fraud.
Go deeper if you need to
The deeper external-exposure review adds internet-facing services, forgotten subdomains and certificate problems, walked through on a 20-minute call.
What the check reads
SPF, DKIM and DMARC
Whether someone can send email that appears to come from you, and what receiving servers are told to do with it.
MTA-STS and TLS reporting
Whether email sent to you must travel encrypted, and whether anyone hears about it when it doesn't.
HTTPS, certificate and headers
Whether visitors always land on the encrypted site, the certificate is trusted and in date, and HSTS and framing protections are set.
Related services and tools
Attack Surface Management
SurfaceLoop - continuous monitoring of your internet-facing assets, as a managed service.
Email Security
Managed email security: the fix for SPF, DKIM and DMARC gaps, plus filtering and phishing defence.
Cyber Essentials readiness assessment
Twenty questions against the five certification controls.
Gaps you'd rather hand over?
AMVIA fixes what this check finds as routine work - email authentication, web server headers and certificates - and monitors your external exposure continuously.
Attack surface scan questions
Everything about your business that is visible and reachable from the internet: domains and subdomains, exposed services and ports, mail configuration, certificates and login pages. It is what an attacker looks at first, because it needs no access and no malware - just looking.
Yes. The nine checks run when you press the button and the results show on the page, with no email address needed.
No. The snapshot reads what is already public: DNS records, the response your website gives any visitor, and the certificate it presents. Nothing is port-scanned, exploited or logged into. The full report uses the same kind of public data - certificate transparency logs and internet-wide service records - not a penetration test.
What a public-settings check cannot see: internet-facing services and ports, forgotten subdomains and certificate problems across your domains. A list like that needs context - which items are real risks, which are expected, and what to fix first - so Nayim walks you through it on a 20-minute call.
Missing SPF or DMARC doesn't mean you've been breached; it means your domain is easier to impersonate, and impersonation is how most invoice fraud starts. The fixes are DNS records, not products, and our email security service sets them up properly as routine work.