Everything the world can see of you, read from where they see it.
Every other module reads the inside of the estate. This one reads what the estate publishes to the world — DNS, mail authentication, certificates and the headers public sites send — and reports where a domain can be spoofed, where mail can be downgraded to plaintext, and where a forgotten record hands a name to a stranger. The first tier needs nothing but a domain name.
SPF, DKIM, DMARC, MTA-STS and TLS-RPT — presence, syntax, enforcement, key strength — plus whether the mail exchangers offer STARTTLS and any dangling MX records. Whether your domain can be spoofed, and whether mail to it can be downgraded to plaintext.
Registrar lock, delegation consistency, nameserver behaviour, CAA records and DNSSEC as a full chain: signed, anchored at the registrar, DS-to-key match, signature expiry and algorithm strength.
For every public hostname: expired or expiring certificates, certificates that do not chain to a trusted root, name mismatches, weak keys and deprecated TLS. Whether plain HTTP redirects and HSTS is actually sent.
With a Cloudflare token: subdomains pointing at retired hosting anyone could re-create, dangling CNAMEs, private addresses in the public zone, the CDN's TLS mode to the origin, and origins reachable around the proxy.
Connect Exchange Online and the module reads what your own mail platform does with mail — accepted domains and DKIM signing, mail flow rules and connectors and whether they require TLS, remote domains, authentication policies, and the anti-spam, anti-phishing, anti-malware, Safe Links and Safe Attachments policies — beside what your domains publish, on the same row.
A policy can be switched on, correctly configured, pass its audit, and sit in the mail path of nobody. The module says which recipients each protection policy reaches — and names domains the tenant sends as that nothing is watching.
Each with the evidence behind it, not just a severity label.
A built-in explainer on every finding — what it is, why it matters, what to do.
Rolled up from the findings and trended over time.
Findings mapped to the framework controls they evidence.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
Findings from this module evidence the mail-authentication, DNS-security, certificate-lifecycle, cryptography and data-in-transit control areas of every activated framework.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.