How secure is your domain?
A free check in a few seconds: see how your email and website are doing. Public data only; nothing is stored.
The form needs JavaScript. You can also email or message me directly. info@kelson365.com
- Your domain receives email via {value}.
- This domain does not receive email. Don't you send email from it either? Then set SPF to 'v=spf1 -all' and DMARC to 'p=reject', so nobody can send email in its name.
- There is one SPF record that defines who may send email on behalf of your domain.
- Without SPF, anyone can send email that appears to come from your domain. Add a TXT record listing the services that send on your behalf, for Microsoft 365 for example 'v=spf1 include:spf.protection.outlook.com -all'.
- There may only be one SPF record; with more, SPF doesn't work at all. Merge them into one record.
- With '+all' anyone may send email on behalf of your domain. Replace it with '-all' (or temporarily '~all').
- Your SPF record doesn't end with '-all' or '~all'. Close it off so receivers know what to do with other senders.
- Receivers reject or flag email that doesn't really come from you.
- Without DMARC, fraudsters can easily send email in your domain's name. Start with 'v=DMARC1; p=none; rua=mailto:…' to receive reports, then move to quarantine and reject.
- You receive reports, but fake email is still delivered. Review the reports, then set the policy to quarantine and later to reject.
- Your outgoing email is digitally signed (selector: {value}).
- No DKIM key was found under the common names. You may use a different name; if not, enable DKIM with your email provider (for Microsoft 365 in the Defender portal, under the email authentication settings).
- Mail servers sending to you must use an encrypted connection.
- MTA-STS is set up but still in testing mode. Review the TLS reports, then switch it to enforce.
- Optional but recommended: MTA-STS makes sure email to you is delivered encrypted.
- You get a report when encrypted delivery to you fails.
- Optional: with a TLS-RPT record you're told when encrypted delivery fails. Goes together with MTA-STS.
- Your DNS is signed, so nobody can return fake answers on the way.
- Enable DNSSEC with your DNS provider and add the DS record at your registrar. That way nobody can forge the answers for your domain.
- Only the certificate authorities you choose may issue certificates for your domain.
- Optional: a CAA record defines which parties may issue certificates for your domain.
- Your website has a working, secure connection.
- Your website can't be reached over a secure connection. Make sure it has a valid certificate.
- Browsers will only use the secure connection from now on.
- HSTS is on, but for less than six months. Set max-age to at least a year (31536000).
- Turn on the Strict-Transport-Security header so browsers never connect insecurely again.
- Anyone typing http:// ends up on the secure site automatically.
- Your site can also be reached insecurely. Redirect all http traffic to https.
- There was no answer over http; that can be perfectly fine.
- Your site controls which scripts and resources may load: a strong lock against injected code.
- Your site has a CSP, but allows inline scripts or styles. That weakens the protection against injected code.
- Optional but strong: a CSP defines which scripts may load, as an extra lock against injected code.
- No website was found; the website checks were skipped.
What does the check look at?
The check only looks at public settings. It is not a penetration test and says nothing about your passwords, devices or the configuration of Microsoft 365 itself; that's what the security assessment is for.
Whether others can send email in your domain's name (SPF, DKIM, DMARC) and whether email to you is delivered encrypted (MTA-STS, TLS-RPT).
Domain
Whether your DNS is signed (DNSSEC), so nobody can return fake answers on the way, and who may issue certificates for your domain (CAA).
Website
Whether your site only works over a secure connection (HTTPS, redirect, HSTS) and whether it controls which scripts may load (Content-Security-Policy).
Good to know
Is my domain stored?
No. The domain is only used for the check and is not kept or logged. To prevent abuse, the service counts per day how many checks come from one IP address, using a hashed form of that address that disappears after two days.
Can I check any domain?
Yes, the check only uses data anyone can look up: DNS records and the front page of the website. Nothing is changed or tested.
All green. Am I secure then?
Your foundation is good, but the biggest risks are often in identities, devices and data. A security assessment does look at those.
Shall we talk?
Would you like a website, or help with your cloud environment? Send me a message.
Prefer a form? Fill in the request