Free DNS & email security check
Find the gaps before attackers do.
Check any domain's DNS and email security in seconds, free. Verify it, and we test your website every two weeks: exact fixes for your engineers, a clear picture and proof for management.
3 of 3 free checks left today · No sign-up. Public DNS data only.
Who it is for
Built for the people who fix it, and the people who answer for it
Security tools usually serve one side. Offensly gives engineers the detail they need and managers the overview they are asked for, from the same tests.
For engineers
Exact findings, not a score
- The record, header or file at fault, with the evidence we saw
- Severity with CVSS and the exact change that fixes it
- Findings tracked across runs: new, fixed, back again
- Scope, hosts and time window under your control
For managers
Continuous testing you can show
- A test every month for $180 a year per domain
- Risk by severity, and what your team fixed since last time
- Timestamped proof of every test for audits and customers
- No software to install, no contract, cancel any time
How it works
From a free check to continuous testing
- 01
Check your domain
Type a domain and run the free check. No sign-up. We read public DNS records only. - 02
Fix what is wrong
Every finding says what is wrong, why it matters and the exact record to add or change. - 03
Upgrade and test your site
With a paid account, add a TXT record and a file to prove the domain and the website are yours. Then we test your website, once or every month.
What you get
DNS checks are free. Web testing comes with a paid account.
Free, no sign-up
Free account: advanced DNS check
Paid account: web testing
Sample result
Specific findings, ready to fix
No scores to decode. Each check says what we found, how serious it is and what to change.
example.com
1 failed · 1 warning · 2 passed
- DMARC policyHigh7.5
No DMARC record at _dmarc.example.com. Anyone can send email that looks like it came from you.
Fix: Add a TXT record on _dmarc.example.com: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
- SPF recordLow3.1
SPF ends with ~all (soft fail): receivers may still accept mail from servers you did not list.
Fix: Change ~all to -all once every server that sends your email is in the record.
- DKIM signing
A DKIM key was found for a common selector (2048-bit RSA).
- MX records
2 mail servers found, both with valid hostnames.
Penetration testing
Your site changes. New vulnerabilities appear every day.
A test from last month says little about today. Continuous testing re-tests your verified domain every month and tells you what is new and what you fixed.
Continuous testing
RecommendedA full test now, then a retest every month for a year.
$180per domain · per year
$15 a test, paid yearly in advance
85% less per test than one-off tests
- A full test right away that sets your baseline
- An automatic retest every month, 12 tests a year
- New, fixed and returning findings on every retest
- Advanced DNS checks (5 a day), as in the free account
- Timestamped proof of permission for every test
- Renews every year; cancel any time before the renewal
One-off test
A single full test when you need it.
$100per test
- One full web penetration test
- Findings with severity, evidence and fixes
- Timestamped proof of permission
- $80 off continuous testing of the domain within 30 days
FAQ
Questions people ask first
Is the free check safe to run on any domain?
Yes. The free check only reads public DNS records, the same data any mail server reads when it receives email from you. It sends nothing to the domain's web or mail servers and changes nothing.
Why do I have to verify my domain for a penetration test?
Because testing a website without its owner's permission is an attack. You put a small file on your website, which proves you control the site we will test; with the scope you confirm, it is your written permission to test it. The same works for a website without a domain, by its IP address (and port). A TXT record in your DNS is optional for testing: it proves the whole domain, adds its www host to the test and unlocks the advanced DNS check. We keep a timestamped record of that permission.
What happens to the domains I check?
Anonymous checks are not stored against you; we keep only what we need to enforce the daily limit. With an account, your checks are saved to your history so you can compare results over time. You can export or delete your data at any time.
What is the difference between the free and the paid account?
The free account adds the advanced DNS check: 5 a day on domains you have verified as yours, with history. It does not test your website. The paid account adds web penetration testing of your verified domains; its DNS checks are the same as in the free account.
How many free checks do I get?
3 basic checks a day on this site, with or without an account. With a free account, also 5 advanced checks a day in the dashboard on domains you have verified. The paid account has the same DNS checks.
Why test every month instead of once?
New vulnerabilities are published every day and we keep adding tests for them. A site that was safe last month may not be safe today. Continuous testing every month also shows whether the problems found earlier are fixed or still open.
See what your domain reveals
The free check takes seconds. Create an account for more checks a day and your history.