Truvo Free Tools

Check your domain's external security posture

See what an attacker sees first: mail records, DNS, HTTPS, browser defences, PHP versions affected by PHP2Shell and forgotten subdomains, graded A to F and mapped to the SOC 2 and ISO 27001 controls each one affects.

Last updated Oct 22, 2026, 12:46 UTC

Example reportexample.com
C74 / 100
Email authentication62
DNS hygiene85
TLS and HTTPS100
HTTP security headers40
Subdomain footprint90
SOC 2 CC6.6SOC 2 CC6.7ISO 27001 A.5.14ISO 27001 A.8.20

Every check is passive and based on publicly observable data. Nothing is sent to non-public endpoints and nothing on your systems is changed. A scan usually completes in under ten seconds.

Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant, built Truvo Exposure

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the domain security scan works

The scan is passive: it reads public DNS records over DNS over HTTPS, makes one normal HTTPS request and one HTTP request to your homepage, and searches public Certificate Transparency logs, and it never probes your systems.

01

Query

You enter a domain. The tool reads its public DNS records (MX, SPF, DMARC, MTA-STS, nameservers, CAA, DNSSEC), requests the homepage once over HTTPS and once over HTTP, and searches Certificate Transparency logs for hostnames under the domain.

02

Read

Findings are grouped in five areas: email authentication, DNS hygiene, TLS and HTTPS, HTTP security headers, and subdomain footprint. Each finding says what was found, why it matters and how to fix it, and the whole result is graded A to F. The headers area also flags an advertised PHP version affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

03

Map

Every finding names the SOC 2 criterion and ISO 27001:2022 Annex A control it gives evidence for or signals a gap against, so you know which audit question a fix answers. The single-check tools below run one area at a time.

Found a gap? We fix it for you.

Truvo's security engineers harden mail, DNS, TLS and web configuration, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • Email authentication

  • DNS hygiene

  • TLS and HSTS

  • Security headers

  • Asset inventory

  • Audit evidence

Domain security scan: frequently asked questions

Five areas of your domain's public configuration: email authentication (MX, SPF, DMARC and MTA-STS), DNS hygiene (nameserver redundancy, CAA and DNSSEC), TLS and HTTPS (reachability, redirect and HSTS), HTTP security headers (CSP, clickjacking protection, MIME sniffing, referrer and permissions policies, server banner and an advertised PHP version affected by PHP2Shell) and subdomain footprint (Certificate Transparency enumeration and non-production host detection).

Yes. The scan reads the PHP version a site advertises in its response headers and flags a version affected by CVE-2026-109618 and CVE-2026-109619, an end-of-life PHP with no official fix, or an OS-packaged PHP to confirm with the vendor. Headers show what a site advertises, so confirm the patch on the server. The PHP2Shell checker runs this check on its own.

Yes. Every check reads public data: DNS records, one normal web request to the homepage, and Certificate Transparency logs. Nothing is probed, written or changed. Running it on a vendor's domain reads the same public information their customers and any attacker can already see.

Each of the five areas starts at 100 and loses points for every finding according to its severity, and the combined result is shown as a letter from A to F. In the email area a missing SPF or DMARC record costs the most, while optional hardening such as MTA-STS costs little. The grade is a quick read of external posture, not a compliance verdict.

Each finding names the SOC 2 Trust Services Criteria and the ISO 27001:2022 Annex A control it relates to, for example CC6.7 and A.5.14 for email authentication or A.8.24 for TLS. The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

No. Enter a domain and the full result appears in seconds. You can optionally leave an email to receive the report, or to ask us to help with what the scan found.