External attack surface
See your company the way an attacker does.
Enter your work email. In about ten seconds we’ll map what your company’s domain shows publicly — nothing to install, nothing to authorize.
Enter your work email to get every finding, on this page and in your inbox.
We’ll send the results to that address, and we may follow up about Tenant Strike. Unsubscribe in one click from anything we send. A domain on its own works too, and shows the first two findings.
No agents · No credentials · Nothing to install
Scan domains you own or administer. By running a scan you accept our Terms and Privacy Policy.
The scan reads published records and the domain’s own public website — mail authentication (SPF, DKIM, DMARC), MTA-STS, domain registration and transfer locks, DNSSEC and CAA, certificate transparency logs, publicly indexed hosts and ports, files like security.txt, and the software and browser protections the home page shows. A WordPress site’s plugins are looked up in WordPress.org’s public directory. No port scanning, no sign-in attempts, nothing private.
This is the outside view only. Most of what goes wrong in a small business is inside Microsoft 365 — MFA gaps, forgotten admins, guest access, Conditional Access. The full scan connects read-only in about five minutes and runs 100+ checks across Microsoft 365 and Azure.