Free external security checks — no signup
See your domain the way
an attacker does.
Veritsu runs nine checks against the security signals anyone on the internet can already read — email authentication, SSL/TLS, security headers, security.txt — and tells you in plain English how to fix whatever fails.
Nine checks. Zero access required.
Everything is verified from the outside — the same way a customer, a partner, or an attacker would see it. Veritsu never asks for credentials, installs an agent, or touches your infrastructure.
Email authentication
Whether someone can send mail that looks like it came from you — and what receivers are told to do when they catch it.
SPF record
Looks up your domain's TXT records and checks that exactly one valid SPF record exists, ending in a terminal mechanism (`-all`, `~all`) or a `redirect=`.
DKIM record
Queries `<selector>._domainkey.<your-domain>` across twenty selectors used by common providers, and confirms a published key carries real key material.
DMARC record
Looks for a `v=DMARC1` TXT record at `_dmarc.<your-domain>`.
DMARC policy strength
Reads the `p=` tag from your DMARC record and grades its strength.
SSL / TLS
Whether the certificate visitors' browsers see is valid, current, and negotiated over a protocol that isn't deprecated.
Certificate validity
Opens a real TLS connection to port 443 and verifies the presented certificate chains to a trusted root and is currently within its validity window.
Certificate expiry window
Reads the certificate's expiry date and reports how many days remain — a warning at 30 days, a failure at 14.
TLS protocol version
Records the protocol version negotiated normally, then opens a second connection offering only TLS 1.0/1.1 to see whether the server still accepts them.
Web hardening
Whether your responses switch on the browser protections that are off by default, and whether researchers can find you.
Security headers
Fetches your homepage over HTTPS and checks for four response headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP `frame-ancestors`), and X-Content-Type-Options.
security.txt
Fetches `/.well-known/security.txt` and validates it as an RFC 9116 file — it must be plain text, carry a `Contact:` field, and have an `Expires:` date in the future.
Every check comes with remediation steps. Read the full reference →
How the score works
No mystery grade out of 100. Each of the nine checks lands in one of three states, and the overall verdict is simply the worst one present.
Pass
The signal is present and correctly configured. Nothing to do.
Warning
Working, but weaker than it should be, or inconclusive — a DMARC policy still set to p=none, a certificate inside its renewal window, a DKIM key we can't confirm.
Fail
The signal is missing, invalid, or actively harmful — no SPF record, an expired certificate, deprecated TLS still accepted.
A single failure makes the whole domain read as Issues detected; any warning without a failure reads as Passing with warnings. In the score ring, a warning counts as half a pass — so a domain with warnings never looks like a clean bill of health.
A badge that can't go stale
Every scanned domain gets a public status page and an embeddable SVG badge. The badge is generated at request time from the latest scan — if a check starts failing, the badge changes on its own. There is no cached image to forget about and no way to freeze it on a good result.
- A single <img> tag — no JavaScript is injected into your site.
- Follows the viewer's light or dark system theme automatically.
- Self-healing: a badge for a domain nobody has scanned lately runs its own scan.
- Links back to the full public report, so the claim is verifiable.
Live on your site
<a href="https://veritsu.com/r/you.com">
<img src="https://veritsu.com/api/badge/you.com"
alt="Veritsu security status" width="234" height="48">
</a>What Veritsu does — and deliberately doesn't
What it does
- Resolves public DNS records (TXT lookups for SPF, DKIM, DMARC).
- Opens a TLS connection to port 443 and reads the certificate.
- Makes one ordinary HTTPS GET to your homepage for its headers.
- Fetches
/.well-known/security.txt.
What it never does
- No credentials, API keys, or account access are ever requested.
- No agent, script, or DNS delegation on your side.
- No port scanning, fuzzing, or vulnerability probing.
- No authenticated or state-changing requests — reads only.
Everything a scan touches is already public. That is the whole point: if Veritsu can see it, so can anyone else.
Also hosted here
FortiAnalyzer Reporter
A Windows tool that automates SD-WAN bandwidth reporting on FortiAnalyzer — queue the reports, let it drive the run, get PDFs back in a dated folder with an Outlook draft ready to send. Downloads, release notes, and roll-back to any earlier version.
See where your domain stands — right now.
Nine checks, about ten seconds, completely free.