Diagnostic

Domain Exposure Check

See what the internet already knows about your domain.

Enter your company's domain. In about a minute I read the public records behind your email, your domain registration and your website, and grade them. The free outline shows how each area scores and names any serious problem. The full report gives you the fixes: your actual records explained, ready-to-paste replacements, steps for the services you use, and a breach check for your email addresses.

Only public records are read: DNS, the registry, and your homepage as any visitor sees it. No logins, no scanning, nothing stored beyond the report you buy.

What it reads

The public picture, graded.

Email authentication

SPF, DKIM and DMARC: whether your domain tells receivers who may send as you, whether your mail is signed, and whether spoofed mail is rejected, quarantined or let through.

Registrar and DNS

Who the domain is registered through, when it expires, whether the transfer lock is on, and which company runs your name servers. For .jp domains, what JPRS publishes.

Website platform

WordPress, Shopify, Squarespace, Webflow, Wix, STUDIO, BASE and about thirty others, plus the hosting in front of them, visible versions and plugins, and open login pages.

Transport and headers

Whether plain HTTP redirects to HTTPS and which of the five common security headers are set.

Breached accounts (full report)

Up to 3 of your email addresses checked against Have I Been Pwned, with the breaches named and whether passwords were among the leaked data.

What it is not

An outside view, not a security audit.

The check uses only what anyone on the internet can already see. It does not attempt logins, scan for vulnerabilities or test your systems, so it cannot prove you are secure or that you have been compromised. A website that blocks automated visitors will show as blocked, which is fine. DKIM can only be found under the usual selector names, so "not found" means ask your email provider, not that it is off.

Breach results come from Have I Been Pwned and cover breaches that have been loaded there. An address that is absent has not been found, which is not the same as safe.

If you want a person on it

External exposure check

I check up to three domains by hand with a real browser: everything here plus public login and admin pages, password rules, certificates and versions, with a written report in five business days and a 30-minute debrief. ¥100,000 + tax.

About the manual check →

Questions first? Discuss your project.