Know how secure your business really is.

Scan your domain and discover security weaknesses in minutes - no account required.

Only scan domains you own or are authorised to assess. This is an automated external assessment, not a penetration test. Payment is handled securely by Stripe.

Email security

SPF, DKIM, DMARC and MX configuration - the controls that stop attackers spoofing your domain.

Website security

HTTPS, TLS certificate health, and the security headers browsers rely on.

Domain security

DNSSEC, CAA, and domain registration status - including expiry, which businesses genuinely lose domains to.

Exposure

Subdomains and infrastructure that are publicly discoverable through legitimate, passive sources.

Reputation

Whether your mail servers are currently listed on spam blocklists that could be silently rejecting your email.

How it works

01

Enter your domain

No account, no sign-up wall - just the domain name. Takes five seconds.

02

We run the checks

13+ checks across email, website, domain, exposure, and reputation - all from the same public sources anyone (attacker included) could already query.

03

Get a plain-English report

A score out of 100, exactly what we found, why it actually matters for your business, and how to fix it - plus a downloadable PDF.

What a finding actually looks like

Not a jargon dump. Every issue we flag comes with the business risk in plain English, a concrete fix, and the raw evidence behind it - these are real examples from an actual scan (domain replaced with a placeholder).

WarningEmail security

DMARC is not configured

Why this mattersThis is the gap that lets attackers send phishing emails that appear to come directly from your business - to your customers, your suppliers, even your own staff. It's one of the most common entry points for invoice fraud and business email compromise, and without DMARC you have zero visibility into it happening.
dns.dmarc
{
  "recordsFound": 0,
  "checked": "_dmarc.acmewidgets.co.uk"
}
WarningExposure

3 subdomains suggesting internal or admin systems, publicly reachable

Why this mattersThese are the subdomains an attacker checks first - internal tooling like this is frequently unpatched, running default credentials, or was never meant to be reachable from the open internet, making it a far easier way in than a well-maintained production site.
exposure.subdomains
{
  "subdomains": [
    "admin.acmewidgets.co.uk",
    "vpn.acmewidgets.co.uk",
    "staging-old.acmewidgets.co.uk"
  ],
  "source": "certificate transparency logs"
}

Questions

Is this a penetration test?

No. Domain Medic runs automated, passive checks against publicly accessible information - DNS records, response headers, certificate data. It never attempts to log in, exploit anything, or access systems that aren't already public. It complements a penetration test; it isn't a substitute for one.

Will scanning my site affect it in any way?

No. Every check is read-only - the same kind of request a browser makes when it visits your site, or a DNS lookup anyone can run. Nothing is modified, nothing is written to, nothing is submitted.

How long does a scan take?

Typically under 10 seconds. All checks run concurrently rather than one after another.

What if I don't understand a finding?

Every finding that needs attention comes with a plain-English ‘why this matters’ and a concrete ‘how to fix it’ - not just a technical label. See the example below.

Is my payment and data handled securely?

Payment is processed entirely by Stripe - we never see or store your card details. We keep only what's needed to show you your report: the domain scanned and the results. See our Privacy Policy for the full detail.

Can I scan a domain I don't own?

Only scan domains you own or are explicitly authorised to assess. Every check here only touches publicly available information, but the results can reveal real weaknesses - treat that responsibly.