Nezaam. Domain security baseline

Self serve check

What your domain tells a stranger.

Type a domain. This reads its public DNS records, one response from its home page, and the public certificate logs. It takes a few seconds, longer when the certificate log is busy, and it touches nothing private.

No account and no email address. The result appears on this page and the link works if you send it to whoever runs your servers.

Why this reads differently.

Around twenty five free tools already read these records. MXToolbox, EasyDMARC, dmarcian, Mozilla Observatory and SSL Labs all return the same facts, and most of them return a red cross next to anything missing.

A DMARC record set to p=none on a domain that published it last week is a rollout working exactly as intended. The same record two years later is a decision nobody got round to making. To a checker that prints FAIL, those are the same result. They are not the same result.

So every finding here carries three things: what was observed, why it might be deliberate, and what would have to be true for it to matter. Where the answer cannot be seen from outside, it says so instead of guessing. DKIM is the clearest case. Nothing in DNS lists a domain's signing selectors, so no external tool can prove a key is absent, and this one does not pretend to.

Scope

What this does not do.

The whole check is passive. It asks for what a browser asks for, reads public DNS through a public resolver, and queries the public certificate logs. If you run this against a domain you do not own, nothing happens that would not happen if you simply visited the site.

  • No port scanning. Nothing is connected to except the web server, on the ports a browser uses.
  • No guessing at file names. No /admin, no /.git, no login pages, no directory listing.
  • No authentication attempts and no altered or unusual input of any kind.
  • Two paths are requested by name, because a published specification says they are there to be read: /.well-known/security.txt from RFC 9116 and /.well-known/mta-sts.txt from RFC 8461.
  • Findings are not proof of a vulnerability. A missing header is a missing control. Whether it can be used against you depends on the application behind it, which a lookup cannot see.

The one check this cannot do.

HMRC requires fraud prevention headers on calls to its APIs, the Gov-Client and Gov-Vendor set. Those travel from your application to HMRC. They are not published in DNS and they are not in any HTTP response, so a domain name reveals nothing about them, here or anywhere else.

Checking whether yours are correct takes about ten minutes and either your sandbox credentials or a conversation with whoever built the integration. If you want that looked at, the address is hello@nezaam.co.uk.