Sign inRun free check
Free check · about 30 seconds · no sign-up

See your domain
the way an attacker does.

OuterMark checks your email, website and DNS from the outside, scores what it finds out of 100 and explains it in plain English. Then we fix it, and keep it fixed.

  • Reads only what is already public
  • No account, nothing to install
  • Built and run in the UK

What you get back

A score out of 100,
and the reasons behind it.

This is a free report for a made-up domain. Yours takes about 30 seconds, and the score appears on this page.

Your free reportExample data

Security score · harbourview.example

Weak

7 findings need attention.

✓ Complete · 40 of 40 checks

By area

Email authentication9 · 3 · 3
Web and TLS10 · 4 · 1
Domain and registration4 · 1 · 0
Identity and brand3 · 1 · 0
Attack surface3 · 0 · 0
Supply chain3 · 1 · 0

Passed · needs a look · failed

Anyone can send email as this domain

DMARC is set to watch only, so a fake invoice from this address would reach the inbox.

The website accepts old encryption

TLS 1.0 is still switched on. Browsers dropped it years ago.

A look-alike domain can send email

A domain one letter away is registered to someone else, with mail switched on.

Get the Full Report · £50See everything we check

What OuterMark does

Find it. Fix it.
Keep it fixed.

Nothing to install and no access to hand over. OuterMark reads what is already public about your domain: the same things an attacker reads first.

See what an attacker sees

Over 40 checks across email, web and TLS, DNS, look-alike domains and exposed services. Each finding says what it means for you, in plain English.

Free checkABOUT 30 SECONDS

Stop email sent in your name

Managed DMARC takes your domain from watching (p=none) to refusing fakes (p=reject) in approved steps, so real email keeps arriving on the way.

PolicyNONE → QUARANTINE → REJECT

Know who sends as you

Every service sending email as your domain gets a name: Microsoft 365, your newsletter tool, your accounts software. The ones that fail get step-by-step fixes.

SendersEVERY ONE NAMED

Email impersonation, explained

How DMARC works, in plain English.

Anyone can type your domain into the From line of an email. Three DNS records decide whether the receiving server believes them.

  1. 01

    Someone sends email as you

    A criminal puts your domain in the From line and sends a fake invoice from a server you have never used.

    From: accounts@yourcompany.co.uk
    Sent by: a server you have never used
  2. 02

    The receiving server checks your DNS

    Before delivering, Microsoft 365, Gmail or whoever receives it looks up your SPF, DKIM and DMARC records.

    Query: _dmarc.yourcompany.co.uk
    Result: SPF fail · DKIM fail
  3. 03

    Your policy decides

    With DMARC at reject, the fake is refused. With DMARC at none it is delivered, and all you get is a report.

    p=reject → refused
    p=none → delivered
Read the full explanation

Why now

The inbox providers
changed the rules.

Ways in

Start free.
Go as far as you need.

Flat prices in pounds. Nothing is metered by how much email you send.

The free check

Free

A score out of 100 and what it means, in about 30 seconds.

Run free check

Full Report

£50one-off, per domain

Every finding with its fix, in priority order, as a PDF you keep.

What is in it Recommended

Managed DMARC

£99a month

We host your DMARC record and walk it to reject, one approved step at a time.

How it works

For MSPs

Quoted

Every client domain in one console, under your brand. One invoice.

Partner programme
See all products and prices

For MSPs and IT providers

Every client domain,
one console.

Put a whole book of clients on managed protection with one bulk request. Your clients see a portal that wears your name, logo and colours. Our engineers do the DMARC work behind it.

500rows in one CSV import
100domains in one bulk request
See the partner programme
Partner console · CustomersExample data

Customers

Harbourview Lettings
harbourview.example✓ Reject
Calder & Finch
calderfinch.exampleQuarantine 50%
Tidewell Dental
tidewell.exampleObserving

Our research

79 of 200 housing associations could be impersonated.

We scanned 200 English housing associations on 12 June 2026. Those 79 could have been impersonated in phishing emails sent to their own tenants.

Read the housing report
31%had DMARC set to watch only
9%had no DMARC record at all
10%had broken SPF's ten-lookup limit
13%published MTA-STS

Source: OuterMark, UK Housing Email Security Report 2026.

Honest by design

Built to be believed.

Unknown is never a pass

A check that cannot finish says unknown. Every score says how complete its scan was.

A person approves every step

No DMARC policy tightens on its own. Every step waits for an engineer to approve it.

No lock-in

Leave, and we hand back your DMARC record with the exact text to publish in its place.

We run it on ourselves

This site and our portal are held to the same checks we run on yours.

Check your domain now.

About 30 seconds. No account. Nothing to install.

PASSIVE CHECKS ONLY · READS PUBLIC RECORDS · NOTHING TO INSTALL