How does your firm look from the outside?
Enter your firm's domain. In about ten seconds you get a letter grade and a plain-English list of what an attacker can see, starting with whether someone can send email pretending to be you.
Passive checks of public DNS and your home page only. The result is yours to keep.
Want the fix list for your firm?
Send us your details and Bryan will reply with what to fix first, in what order, and roughly what it takes. No obligation.
What we check
Every check is something your clients, your insurer and an attacker can already see. Each one maps to a control in IRS Publication 4557 or the FTC Safeguards Rule.
- Email spoofing protection. SPF, DKIM and DMARC, the three records that stop fake emails in your firm's name.
- Encrypted website. HTTPS with a valid certificate, and a redirect from the insecure version.
- Browser protections. Four standard security headers that stop common website tricks.
- Domain hygiene. DNSSEC and CAA records that make your domain harder to hijack or impersonate.
About the grade
What does the free security grade check?
Only what anyone on the internet can already see: your email authentication records (SPF, DKIM and DMARC), whether your website uses HTTPS and redirects to it, standard browser security headers, DNSSEC and CAA records. Nothing is installed and nothing on your network is touched.
Is the scan safe to run?
Yes. It reads public DNS and loads your home page once, the same way a visitor would. It does not probe ports, try passwords or test for vulnerabilities.
Why does DMARC matter so much for a tax firm?
Without an enforced DMARC policy, anyone can send email that appears to come from your firm. Criminals use that to send fake payment requests and W-2 requests to your clients. It is the single most common gap we find.
Does a good grade mean we are secure?
No. It means the parts visible from outside are set up well. Most risk sits inside the office: computers, backups, passwords and staff habits. That is what an on-site assessment covers.