- Home
- Free tools
Check your email, domain, website and tenant in seconds.
The same checks we run at the start of every security and platform engagement, free to use. Each one explains what it found and what to do about it, in plain English.
Server-side checks read only public records and responses. The header analyser and the two generators run entirely in your browser: nothing you paste is sent anywhere.
Email health check
SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT for any domain, graded A to F, with the include chain expanded and the 10-lookup limit counted. Detects Google Workspace, Microsoft 365 and most sending platforms.
Check a domain TOOL 02 · EMAILEmail header analyser
Paste the headers of a suspicious or delayed message. See who really sent it, whether SPF, DKIM and DMARC passed, the hop-by-hop delivery path with delays, and Microsoft or Google filter verdicts. Runs in your browser.
Analyse headers TOOL 08 · EMAILSPF and DMARC generator
Tick the platforms that send as your domain and get the SPF and DMARC records to publish, with the lookup count and where each platform's DKIM key is configured. Browser-only.
Build the records TOOL 03 · WEBWebsite check
TLS certificate and protocol, HTTP to HTTPS redirects, security headers graded A to F, cookie flags, compression, on-page SEO basics, robots.txt, sitemap and security.txt.
Check a website TOOL 10 · WEBPage speed
Google Lighthouse scores for performance, accessibility, best practices and SEO on mobile and desktop, with Core Web Vitals, real-user Chrome data where it exists, and the changes that would save the most time.
Test a page TOOL 09 · WEBSecurity headers generator
Choose the services your site uses and get a Content-Security-Policy and the other headers as config for Cloudflare, Vercel, Netlify, Nginx, Apache, IIS, Next.js or Express. Pre-fills from the website check.
Generate headers TOOL 07 · PHISHINGLink safety check
Paste a link before anyone clicks it. Expands shorteners and redirects on our servers, then looks for look-alike domains, brand impersonation, new registrations, password pages and threat-list listings.
Check a link TOOL 05 · DOMAINDomain overview
Registrar, registration status and DNSSEC, name servers and DNS host, mail provider, web host and network owner, plus domain and certificate expiry on one page.
Show overview TOOL 04 · DNSDNS lookup
A, AAAA, MX, NS, TXT, CNAME, SOA, CAA and SRV records, reverse lookups for IP addresses, and a propagation check that asks each authoritative name server directly.
Look up a record TOOL 06 · MICROSOFT 365Microsoft 365 tenant lookup
Tenant ID and data region, managed or federated sign-in, Exchange Online routing, DKIM, Autodiscover, Entra device registration and Intune enrolment records for any domain. Public endpoints only.
Look up a tenantWhy we publish these
Most email spoofing and website security problems we find in Australian small and mid-sized businesses are configuration gaps, not sophisticated attacks: an SPF record that was never finished, a DMARC policy left at monitoring, a certificate nobody is watching, a site with no security headers at all. These tools let you find those gaps yourself before someone else does.
Every check is read-only and uses information any mail server or browser already sees. We do not scan ports, test for vulnerabilities, or send mail to the domain. Requests are rate-limited per network, and the header analyser never uploads what you paste.
If a result needs fixing and you would rather have it done properly, that is the work described under Cybersecurity, Identity & Governance and Intelligent Web Platforms.
Found something you would rather not fix alone?
An identity and tenant review covers email authentication, Microsoft 365 or Google Workspace security, endpoints and the website in one prioritised roadmap.