What it adds
The instant snapshot covers your registered domain and www root pages. The expanded review aims to inventory all public subdomains discoverable in certificate-transparency logs for the agreed domain. Logs can contain historical or wildcard entries and cannot guarantee a complete list of active hosts. We confirm which names belong in the review before checking them.
Within the agreed public inventory, it adds HTTPS, certificate and header checks across those hosts; deeper email authentication review using legitimate DKIM selectors, MTA-STS, TLS-RPT, BIMI and DNSSEC evidence; and a third-party script inventory on agreed key public pages.
It also reviews available lookalike-domain registration evidence. A similar registered name is a lead for investigation, not proof of malicious activity or shared ownership. Public data can be incomplete or dated. We do not register domains, contact registrants or claim services as part of the review.
Each additional check depends on available evidence and the agreed scope. Publishing MTA-STS or BIMI, for example, is not proof that every receiver applies a particular behavior. Unknowns and exclusions remain explicit.
What you receive
A dated, IT-ready remediation pack connects each supported observation to the relevant host or service, its source, a proposed owner and an order of work. It separates immediate configuration questions from changes that require application testing or provider coordination.
Your team receives suggested validation steps, dependencies and unresolved questions. The aim is a practical work plan that an IT owner can review and accept, with no certification or guarantee that every risk has been found.
What requires written authorization
The public review does not include logins, scans of non-public services or active testing without separate written authorization. It does not submit forms, attempt exploitation or use the instant domain confirmation to expand permission.
Any later testing requires an asset-specific agreement covering methods, timing, evidence handling and stop conditions. A report request or contact detail does not provide that authority.
How it leads to a scoped full audit
The remediation pack helps identify questions that public evidence cannot answer: access control, MFA, backups, endpoint protection and incident response. A scoped full engagement can then agree the business purpose, internal evidence, responsible teams and any permitted testing. Scope and commercial terms are agreed separately before that work begins.
Run the free audit first
Enter your domain to return to the instant audit and review its scope. This form does not request or start an expanded review.