Free · no account required
Two Free Security Checks
Start with a free public domain check, then request an authorised Microsoft 365 review. Understand the priorities before approving any paid work.
See an illustrative sample report · Prefer a 15-minute discovery call?
Run your security check
Check your public email and website settings. We show the results here and attempt to send a copy of your report by email.
What we check
Our check reviews public DNS and makes limited HTTP/TLS connections. No credentials are required, and we do not carry out intrusive probing.
Email Authentication
SPF Record
Sender Policy Framework: authorises servers to send email on your behalf.
DKIM
DomainKeys Identified Mail: cryptographic email signing.
DMARC Policy
Domain-based Message Authentication: controls what happens to unauthenticated email.
MX Records
Mail exchange records: identifies your email server configuration.
Web Security
TLS Configuration
Transport Layer Security: encrypts data in transit to your web server.
Security Headers
HTTP security headers: browser-enforced protections against common attacks.
Exposure Checks
HTTP Exposure
Checks whether your domain forces visitors to a secure HTTPS connection.
Breach history — not included
The public scan does not query breach data or establish whether an account has been compromised.
Areas we review
Questions an authorised assessment can answer
These examples explain the scope of a review. They are not findings about your organisation.
MFA is on, but not enforced
Registration alone does not prove MFA enforcement. We review applicable policies and exceptions with authorised access.
Legacy authentication still active
Legacy authentication does not support MFA. Conditional Access or security defaults can block it; we verify your configuration and dependencies.
Conditional Access gaps
Policies exist but have exceptions. Specific apps, locations, or user accounts fall outside the coverage.
DMARC set to p=none
The domain has a DMARC record but enforcement is off. Receiving servers may still apply other protections; enforcement should follow a review of legitimate senders.
No backup for M365 data
Microsoft 365 includes retention and recovery features. We review whether configured retention, restore options and any separate backup meet your recovery needs.
Shared mailboxes without controls
We review direct sign-in restrictions, delegated access, user protection and audit settings. A shared mailbox is not automatically an MFA bypass.
Step 2: Go deeper
Free M365 Security
Posture Assessment
Your domain scan shows the public-facing picture. A Microsoft 365 Security Posture Assessment reviews the account, access and configuration controls included in the agreed scope. We verify your authority and the required permissions before accessing your tenant.
The free assessment includes an executive summary, prioritised findings, an explanation of evidence gaps and a discussion. Any remediation or ongoing management is separately scoped and priced. The checks we can run depend on permissions and licences.
- Conditional Access policy review
- MFA enforcement gaps
- Legacy authentication exposure
- Mailbox & delegate permissions audit
- SharePoint & OneDrive external sharing
- Exchange Online protection configuration
- Azure AD / Entra identity hygiene
- Microsoft Secure Score analysis
Request your free assessment
Start with your contact details. You do not need to provide passwords.
Privacy & how we use your data
We use your details to deliver your requested report or respond to your enquiry. Hosting, email and security service providers help process these requests as described in our privacy policy. The domain check uses public DNS and limited HTTP/TLS connections. It does not access your Microsoft 365 tenant or subscribe you to marketing.