How it works

From a free check to continuous testing, in three steps

Each step goes deeper: the free check needs nothing, a free account adds the advanced DNS check of domains you prove are yours, and a paid account adds web testing of them.

  1. 01

    Check any domain

    Type a domain on the home page. We read its public DNS and check email security: SPF, DKIM, DMARC, MX. 3 checks a day, no sign-up.
  2. 02

    Create a free account

    Sign in with Google and verify your domain with a DNS record. You get the advanced DNS check, 5 a day, and a history to compare results. DNS only, no web testing.
  3. 03

    Upgrade and test

    Web testing is in the paid account. Add a file to your website as well, and we test it, once or every month.

What happens when you verify a domain

  1. You create a project in the dashboard: the domain, the hosts and URLs to test, and the time window.
  2. We show you a TXT record with a unique token, and how to add it at the most common DNS providers. For penetration tests you upload a file with the same token to /.well-known/offensly-verification: the file proves the website we test, the record the whole domain (optional for tests; with it we also test the www host).
  3. You confirm the scope: that you own the target or are allowed to test it, which test, and when.
  4. We find the record. Press Verify and we keep looking for 24 hours, because DNS changes can take hours to show up, and email you when we find it. The project moves from Pending verification to Verified.
  5. We record the permission: the DNS answer we saw, your confirmed scope and the exact time, sealed with a qualified eIDAS timestamp. You can download it.
  6. The test runs and the results appear in the project. With continuous testing a new run starts every month, after we check the file is still there.

If the record disappears, the project changes to Verification lost and tests stop until you add it again.

Start with the free check

Check your domainCreate a free account