The free check
Free
What an attacker sees, in about 30 seconds.
- A score out of 100, and a word for it
- How many findings need attention
- A free report by email: each danger in plain English
- No account, nothing to install
The free check
Find out what an attacker can see. In about 30 seconds.
Type in a domain. OuterMark runs over 40 checks on its email, website and DNS, and gives it a score out of 100 with the reasons in plain English.
- Reads only what is already public
- No account, nothing to install
- Works on any domain
How it works
- 01
Type in a domain
No account and nothing to install. The check reads what is already public: DNS records, the website's front page and public indexes.
domain: yourcompany.co.uk - 02
Wait about 30 seconds
You see each area being checked as it happens.
Checking DMARC policy… - 03
See your score
A score out of 100, a word for it, and how many findings need attention. It also says how many of the checks finished.
58 · Weak · 40 of 40 checks - 04
Get the free report
Leave an email address and we send a private link: the score, and each way an attacker could harm you, in plain English. You can open a free dashboard as well.
report: sent to you, nobody else
What it looks at
Six areas. Over 40 checks.
Email authentication · 15 checks
Can someone send email as you?
Email was built on trust: any server can put your domain in the From line.
Web and TLS · 15 checks
Is your website set up safely?
These checks read your website's front page and the encrypted connection to it: the certificate, the versions of TLS it accepts, and the security headers that browsers rely on.
Domain and registration · 5 checks
Could you lose the domain, or part of it?
Your domain is the root of your website and your email.
Identity and brand · 4 checks
Who could pass themselves off as you?
Attackers register domains that look almost like yours, and work out how your staff email addresses are formed.
Attack surface · 3 checks
What have you left open to the internet?
Some services publish a searchable index of what every internet address exposes.
Supply chain · 4 checks
Whose code runs on your website?
Most websites load code from other companies.
What each level gets you
Full Report
£50one-off, per domain
Every finding, and the fix for each.
- Every finding with its severity
- A step-by-step fix for each one
- A plan in priority order
- A PDF to hand to IT or a supplier
- Yours to keep, no subscription
Credited back if you go on to a fix project.
Posture Monitoring
£29a month, per domain
The Full Report, kept live. Or £290 a year.
- Re-checked every night
- An email when something changes
- Your score tracked over time
- Mail servers watched against Spamhaus blocklists
- First month free with the Full Report
Comes after the Full Report, which is what it keeps up to date. Cancel any time.
Have us fix it
Quoteda fixed price for the job
We make the fixes and prove them.
- Email, web, DNS and exposure fixes
- Done by our engineers
- A before-and-after scan as proof
- No ongoing commitment
Honest by design
Unknown is never a pass
A check that cannot finish says unknown. It never counts as a pass.
The score says how complete it is
A scan missing a quarter or more of its checks is marked Incomplete and is not given a word.
It is not a penetration test
Nothing here tries a password or probes for a way in.
Questions
Do I need permission to check a domain?
The check reads only what any visitor or mail server can already see, so it works on any domain. The Full Report is for domains you own or look after.
What do you do with my email address?
We use it to send your report and to set up your free dashboard. We do not add you to a mailing list. You can ask us to delete your data at any time. See the privacy notice.
Why did my score change between two checks?
Usually because something changed: a certificate renewed, a record was edited. Sometimes a lookup did not finish the first time. The completeness line tells you which.
Why is my score lower than another tool's?
Most tools grade email alone. OuterMark also grades the website, the domain's registration and what is exposed to the internet, and it caps the score of any domain that can still be impersonated.
Can I check a domain that has no website?
Yes. The domain's website checks read "not applicable" and the rest are scored as usual.