Check your domain's cyber risk, free
Enter a domain and see its risk score, the findings behind it and what could not be checked, from public evidence in about 30 seconds.
Last reviewed
Check a domain
Every scan returns the same three things.
The results open in the TrustSek app, and you see them as the sources report in.
- A risk score. The score is a multiplier against a baseline, not a grade out of 100. A score of 3.0× means the evidence puts the domain at three times the baseline the scoring policy assumes for an average organisation. Every score falls into one of four bands.
- Findings, each explained. Every finding says what was tested, why it matters, what the impact could be and how to fix it.
- What was not checked. A source that failed or was not asked is shown as such. It is never counted as a clean result.
Email security · Medium severity
DMARC policy is set to none
- What was tested
- The DMARC record published at
_dmarc.example.com. - Why it matters
- Without an enforcing policy, anyone can send mail that appears to come from your domain.
- Impact
- Phishing and invoice fraud in your name, aimed at your customers and staff.
- How to fix it
- Monitor DMARC reports, then move the policy from
p=nonetop=quarantineand on top=reject.
The score is built from six modules.
Each one has a fixed weight in the published scoring policy, and each has its own page explaining what it looks at.
| Module | Weight | What it looks at |
|---|---|---|
| Email securitySPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy. | 20% | SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy. |
| TLS and web hygieneWhether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags. | 20% | Whether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags. |
| Ransomware exposureClaims naming the organisation on ransomware leak sites, from two independent trackers. | 20% | Claims naming the organisation on ransomware leak sites, from two independent trackers. |
| ReputationThe domain and its addresses on threat-intel, malware, phishing and botnet lists. | 15% | The domain and its addresses on threat-intel, malware, phishing and botnet lists. |
| VulnerabilitiesAdvertised software versions matched against known-exploited and published vulnerabilities. | 15% | Advertised software versions matched against known-exploited and published vulnerabilities. |
| Attack surfaceSubdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains. | 10% | Subdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains. |
The methodology explains how these weights, severity and confidence combine into the score.
It takes about 30 seconds.
You can watch each source report as it finishes. Some sources answer faster than others, and a slow one never holds up the rest: if it times out, it is marked as failed and the scan carries on.
No agents, no access, no intrusive testing.
- No agents and no access. Nothing is installed, and we never log in to your systems or ask for credentials.
- No intrusive testing. This is not a penetration test or an active vulnerability scan. We do not send exploit payloads, try passwords or probe for weaknesses.
- Public evidence only. Most of what we use is already public: DNS records, certificate transparency logs, threat-intelligence lists and ransomware leak-site trackers.
The scan is not completely hands-off, and we say so plainly. To read your certificate and web configuration, it opens one TLS connection to your website and requests the home page over HTTPS and over HTTP, the way a browser would. If you publish an MTA-STS policy, it fetches that file too. Requests identify themselves as TrustSek/1.0. It does not crawl the site, follow links or submit forms.
A result with no findings means we found nothing in the evidence we could see. It does not mean the domain is secure, and it says nothing about what sits behind your login pages.
What happens to the domain you enter?
The domain you enter and the result of the scan are stored by the TrustSek app. Do not treat a check as private: enter a domain only if you are comfortable with that. The check needs nothing but the domain name, so we ask for no name, email address or other personal details.
Read the privacy policy for how this site handles personal data.
Questions
Can I check a domain I do not own?
Yes. The check uses public evidence, so it works the same for your own domain, a supplier's, a client's or a prospect's. Nobody has to grant access or answer anything first.
Will the domain owner notice?
Nobody is contacted. The few requests to the website identify themselves as TrustSek/1.0, so they can show up in the site's own server logs, the same way any visitor does.
Does it cost anything?
No. The check is free and needs no account and no card. You only need an account to save results and add suppliers.
How do I improve my score?
Fix the findings. Each one says what was found, why it matters and how to fix it, most often a DNS record or a web server setting. Run the check again afterwards to see the change from the outside.
Save the result, then add your suppliers.
Sign up to save results, re-run a scan when you have fixed something, and add the suppliers you depend on. For companies shows how that works; for insurers and for IT partners cover scoring domains you do not own.
Check another domain
A supplier's domain works too. You only need the domain name.