Give us your domain.
Within three business days you get a short written report on what is publicly discoverable about your business right now: your email authentication, your certificates, your website's security headers, who owns your domain, and the forgotten corners most owners never look at.
A real report. We ran it on our own domain first.
Five checks. Public records only.
Everything below is readable by anyone with a browser and a terminal. We are not guessing, and we are not scanning you to find it.
Email authentication
SPF, DMARC policy, and the DKIM selector your mail provider published.
Anyone can send email that appears to come from your domain right now. This is the finding owners are never told and the one that costs the most when it lands.
TLS certificate
Issuer, expiry date, days remaining, and whether the chain actually validates.
An expired or broken certificate is the one failure every single visitor sees, and most of them leave instead of clicking through.
Security headers
HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
Five instructions your site gives the browser, or fails to give. All five are configuration changes, not projects.
WHOIS and registration
Registrar, creation date, expiry date, published registrant, privacy protection.
A lapsed domain takes the website, the email, and every saved link with it. It expires once every few years, which is exactly why nobody diarises it.
Public DNS
A, AAAA, MX and NS records, plus records that point at nothing.
Dead records are how mail starts disappearing quietly, and how a name your DNS still points at gets claimed by someone else.
Every finding names its own proof.
No finding goes in the report without the record, the header, or the certificate that produced it. Your IT person can reproduce every line with one command.
That single rule is the difference between this and a twenty dollar templated scan that tells you to panic and offers nothing you can hand to a technician.
DMARC is set to p=none, observing and not enforcing
Policy value: p=none.
You have told the world to watch, not to act. Mail that fails authentication is delivered anyway, so anyone can still send email that appears to come from your business.
Once SPF and DKIM are clean for every real sender, move to quarantine, then reject. Two weeks between steps.
We do this free because the report is the argument.
If it comes back clean, you have lost nothing and you know your domain is tighter than most. If it does not, and it usually does not, you will have the evidence in your hand and a list of what to fix first.
One line in that report will be a number: how many of the five checks need attention. Not a score out of a hundred. Not an adjective. A count, with the proof behind it.
Prepared by franklin@prospyr305.com. Questions before you send a domain? (561) 990-2428.
Two fields.
Your domain, and where to send the report. That is the entire intake, so there is no step after this one where we ask you for something we should have asked for now.
What this report is not.
Written down because a security report that hides its limits is not worth the paper it is printed on.
- Not a scan. No port scans, no service probing, no vulnerability scanning.
- Not authenticated. We never log in to anything you own, and no test email is sent.
- Not a guarantee. It documents what is publicly visible, and public records cannot see inside your network.
- Not a snapshot of tomorrow. One point in time, on the date printed on it.
Want the systems behind the curtain tested, with written authorisation? That is the SENTINEL Active Assessment, and we scope it before we quote it. See what active testing covers.