Anyone can look up your domain. Look first.

No. It's a free outside look for known, common problems, the same first look an attacker takes. A penetration test is a scoped, authorized engagement where people try to get in. If you need one, we can talk you through what it involves.

About 15 requests. Most are ordinary page and DNS lookups. A few ask for files that should never be public, such as backup and configuration files, and a few use old encryption versions no browser would use. It never tries a password, never submits a form and never looks behind a login.

No. We look up as many as 150 look-alike names in public DNS to see whether each is registered, can receive email or points to a server. We never connect to them. A name that uses your own name servers is marked “likely yours”.

Because too few of its checks could run this time, and a grade on a partial look would mislead you. We show what we found and what we couldn't check. The overall grade needs the Website and Email sections. A section we couldn't check is left out of it, and we say which.

They appear on this page, in this browser session. You can't come back to them later, so the PDF is what you keep. To download the full report or print it, we ask for your name, company and work email, and confirm the email with a 6-digit code once per session. We keep a copy of the report and a record of this scan so our team can follow up; the Privacy Notice and How We Use AI say more. We keep the scan itself for about 15 minutes, then delete it. To stop abuse, each scan is recorded in an audit log with the time, your connection's address and the domain scanned, and the page uses Cloudflare Turnstile as a bot check.

Optional parts of the same report. After the scan you can answer the questions from our Microsoft 365 and Google Workspace security checklist, and from our two cyber insurance tools, so the report also covers what a scan can't see. These answers are yours, so the report marks them self-reported and never blends them into the outside grade. They are saved in this browser for the domain you scanned, so you can come back to them. They reach us only when you press Download full report, and then they are part of the copy of the report we keep. A button under the report clears them from this browser.

After a scan, the Email section can give you a one-time address. Send any short email to it from your work mailbox and we show how SPF, DKIM and DMARC handled the message. We read only how the message was authenticated (SPF, DKIM and DMARC) and the sender's domain, never its subject, body or address. The result is deleted within 40 minutes. The address works once.

Any public domain, with one exception: IA and Argos domains can't be scanned. The deeper check is different: it contacts a site more actively, so it runs only after you prove you own the domain.

No. Breach data stays out of a scan anyone can run on anyone's domain. To check whether an address showed up in a breach, use Argos Exposure.

What you type, plus the domain, its grades and the number of findings. Never the details of what we found. Like every page on intelamation.com, this page also loads the site's analytics and cookie scripts.