External surface readout
Every domain broadcasts. Surface listens.
Type a domain. Surface reads what the public record already says about it — who may send mail as you, what your certificate covers, what your headers permit, what is reachable that should not be — and reports it in plain language.
What gets read
Five surfaces, one verdict
Email authentication
Who can send as you
Can someone send mail pretending to be you?
SPF · DMARC · DKIM35
HTTP headers
What the browser may do
Does the browser get told what it may and may not do?
HSTS · CSP · Cookies · CORS25
TLS & certificate
What the lock covers
Is the certificate valid, current, and does it cover you?
Expiry · Coverage · Protocol20
DNS
Who answers for you
Can your DNS answers be forged, and who may issue your certificates?
DNSSEC · CAA · NS12
Bar length = weight, against the heaviest surface
Log