Free tool
Domain security check
A passive look at the email and website settings anyone can see for your domain, with a plain-language summary and specific fixes. Prove you control the domain first; nothing is checked before that.
How the check works
Verify
Show that you control the domain, by email or with a DNS record.
Run
Start the check from the verified page. It usually takes under a minute.
Fix
Read the grade, the priorities and a specific fix for every finding.
Privacy: Fortress keeps no database for this tool: each request is processed when you make it and nothing about the check is stored on our servers. The report is shown here and, with the email method, emailed to you. Our team gets a short notice with the domain, the grade and the verification method; your email address is included only if you tick “An engineer may email me once about these results”. No AI is involved: the checks and the summary are plain code. Emails are delivered by Resend. Our hosting and email providers keep their own delivery and request logs. See the privacy policy.
What it checks
Email security
- Mail servers (MX)
- SPF: one record, its all qualifier, and the 10-lookup limit
- DMARC: policy, coverage, subdomains and reporting
- DKIM at common selectors (for information)
- MTA-STS and TLS reporting
- BIMI (for information)
Website and TLS
- HTTPS, and whether plain HTTP redirects to it
- HSTS, Content-Security-Policy, X-Content-Type-Options
- Frame protection, Referrer-Policy, Permissions-Policy
- Software versions disclosed in headers
- The TLS certificate (trust, name, expiry) and protocol version
- security.txt
DNS
- CAA: which certificate authorities may issue for the domain
Passive, and only after verification
The check reads only what an ordinary mail server or browser sees: public DNS records, one visit to your home page over HTTPS and one over HTTP, the certificate it presents, your security.txt file and, if you publish one, your MTA-STS policy. There is no port scanning, no crawling, no login attempts and no vulnerability probing.
Before you verify, nothing about the domain is looked up. The one exception is the DNS method’s Verify button, which reads exactly one TXT record: the one you were asked to publish. Verification links are valid for 60 minutes, a DNS verification for 30, and the check runs only when you press “Run the check”.
How the grade works: Score = 100 − 12 per fail − 4 per warning (passes and informational findings don't count). A is 90 or more, B 80, C 65, D 50, F below 50.
What it is not
This is a passive check of public DNS records and of what your website sends to any visitor. It is not a penetration test or a vulnerability scan: it does not test your applications, servers or network for weaknesses, does not log in, and sees nothing that isn’t public. A good grade does not mean the domain is secure.
Go further
Need more than a passive check?Ask for a full assessment.
A penetration test or infrastructure review looks for the weaknesses a passive check cannot see. Tell us about your environment and we’ll discuss the scope.