How to check your company's external security posture for free

There are three free routes, and they are not equivalent. The first is a manual pass on your own domain: fastest, most educational, no account required. The second is reading a published example report to understand what a scored assessment contains — this project publishes a recorded one for example.com. The third is a free tier of some commercial scanner, which usually trades coverage or history for the price.

Start with the first. It takes about twenty-five minutes and it will change how you read every other report you receive.

The routine

Run these against your own domain from a machine outside your office network. The difference matters: a firewall rule that blocks the office does not block a customer.

# 1. mail authentication policy
dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com

# 2. DNS integrity
dig +short DS yourdomain.com
dig +short CAA yourdomain.com

# 3. mail routing
dig +short MX yourdomain.com

# 4. web transport and headers
curl -sSIL https://yourdomain.com | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy|^server|^location'

Then two things a terminal will not tell you: whether the certificate covers the hostname you actually use (open the site in a browser and read the padlock details), and whether any subdomain still points at a service you have closed (check each CNAME you know about, and see the fifteen-check list for the detail).

What to write down

The observation is the deliverable. A verdict without one cannot be compared later, and "DMARC was fine in March" is not a finding. Keep a table like this one, one row per control:

Five rows is a legitimate baseline. Ten is better. What matters is that the same rows are checked the same way next time.

What to fix first

Order by consequence, not by the number of items. A domain that anyone can forge will be used for invoice fraud against your customers; a missing Permissions-Policy header will not. In practice the order is almost always: DMARC enforcement, exposed remote access, then certificate and redirect hygiene, then headers.

Two of those are DNS edits and one is a firewall rule. That is the honest shape of external posture work at this size — unglamorous, and done in an afternoon.

What free cannot give you

• Consistency. Two people checking by hand will classify the same soft SPF record differently. A score needs a fixed rule.
• Weighting. Deciding whether a missing CSP matters more than a weak DMARC policy is a judgement call you will make differently every quarter.
• History. Without a stored, comparable result, drift is invisible.
• Coverage. Every subdomain, every domain, every time — repeatedly, and without forgetting one.
• An artefact. If a customer or insurer asks for evidence, a spreadsheet you maintain is weaker than a timestamped report with quoted observations.

If your situation is one domain, checked quarterly, by one person, manual is genuinely enough. The case for a tool starts when there are multiple domains, more than one person, or an external party asking for proof.

Try it on a domain that is not yours

The public sandbox behind this site runs against five allowlisted domains: example.com, example.org, example.net, scanme.nmap.org and badssl.com. You cannot point it at your own domain — that restriction is deliberate and documented on limitations, because a public scanner that will point anywhere is a weapon with a form on the front. What it is good for is seeing the method: the recorded assessment shows eight concluded controls with quoted evidence and a score of 86/100, grade B, including two warnings you can read and verify yourself.

A private assessment of your own domain runs under a written scope and consent record. If you want that, the request form is the way in; if you would rather do the twenty-five minutes yourself, the table above is the whole method.

What SMB Scanner Lite checks here

These are the controls from this area that the assessment evaluates from outside, without credentials and without touching anything private. Each one returns a status and, for every conclusive result, the record, header or handshake that produced it.

Only assess domains you own or are authorised to test — see responsible use. The published recorded assessment shows how a result and its evidence appear in a report, and the control catalog lists all 22 controls with their weights. Reference detail for this topic lives in External security posture assessment: what it measures.