Two practical checks. One serious security report.
Scan a domain for the hardening details attackers and auditors look at first. Then test whether your real emails authenticate and arrive cleanly. No account, no tracking, no paywall.
By starting a scan you confirm you are only testing systems you are authorized to test.
Domain verification required
You can only scan domains you can prove you control. That's for two good reasons: nobody can start a scan against a domain that isn't theirs or get it listed on the public leaderboard without permission. And once you verify ownership, you unlock the full report for yourself too, with every individual finding plus step-by-step fix guidance, not just the overall grade.
This site uses exactly one cookie, and only if you verify a domain. See what it does below.
Cookie notice
This service uses exactly one cookie, described below. No third-party cookies, no tracking, no advertising. Ever.
Domain-verification cookieEssential
Set only after you successfully prove control over a domain (DNS TXT record or well-known file) to unlock its full scan report. Cookie name: sys_owner_<domain>. HttpOnly (unreadable by any script), Secure, SameSite=Lax, sent only to this site. Purpose: on later visits, it proves that you are the person who verified this exact domain, so only you (not anyone who finds the domain on the public leaderboard) see the full report with individual findings and fix guidance. Never used for tracking or analytics, and never shared with third parties. Expires after 365 days, matching the verification period itself. This cookie is essential to the verification feature and is only ever set when you actively use it. It is never set on a normal visit.