Domain & DNS security

Map your real internet footprint — and lock it down.

Enumerate every subdomain, catch dangling records ripe for takeover, and check your email-spoofing posture (DMARC/SPF/DKIM). The attacker's-eye view of your domain, turned into a fix list.

Wraps best-in-class OSS · grounded, low false positives · fixes are human-approved

What we assess

Coverage that maps to real risk.

Subdomain enumeration

subfinder + amass + Certificate Transparency map every subdomain — including the ones you forgot.

Subdomain takeover

Dangling DNS records pointing at deprovisioned services — the classic, high-impact hijack — are flagged.

Email spoofing posture

DMARC/SPF/DKIM checked from public DNS, so phishing-enabling gaps are caught with the exact record to publish.

Look-alike domains

dnstwist surfaces registered typosquats imitating your brand for phishing.

Powered by subfinder, amass, checkdmarc, dnstwist — best-in-class OSS, wrapped (never re-built in-house), so coverage equals the standalone tool.

How it works

From target to fix, grounded at every step.

1
Enumerate

Passive + active subdomain discovery (subfinder/amass/crt.sh) maps the full surface from a single apex domain.

2
Pivot to children

Live discovered hosts become child assets — so a subdomain that's a real web app gets a real web scan, not re-enumeration.

3
Check email + takeover

DMARC/SPF/DKIM and dangling-record checks run, each with the concrete record or cleanup to apply.

Compliance mapping. Domain findings map to SOC 2 (CC6.6/CC7.1), CIS 9.5 (email), and GDPR Art. 32 where a nexus exists.
Three ways to run it

The product, or the product + an expert.

The hard calls — the judgment, the legal attestation, the named accountability — are a human's. The only question is whose.

Frequently asked

What does a domain scan find?

Every subdomain (incl. forgotten ones), dangling records vulnerable to takeover, your email-spoofing posture (DMARC/SPF/DKIM), and registered look-alike/typosquat domains.

Does it scan the subdomains it finds?

Yes — a live discovered host becomes a child asset and gets the right scan (web, IP) instead of being re-enumerated, so coverage compounds.

Can it fix email spoofing?

It checks DMARC/SPF/DKIM from public DNS and hands you the exact TXT record to publish — the highest-leverage anti-phishing fix.

Scan a domain in minutes.

Start free, or have our expert run the whole engagement for you. Either way, you get a grounded, audit-ready result — not a noisy report you have to triage.