example.test

Method We query public DNS for MX, SPF, DMARC, DNSKEY, MTA-STS and eight common DKIM selectors, using an independent resolver after a resolver failure.

What the result means Missing or permissive mail policies can weaken protection against domain impersonation. Legitimate senders must be inventoried before tightening a policy.

Scope and limitations DNSKEY and MTA-STS checks confirm record presence only. DKIM discovery covers common selectors, not every possible selector. DNS responses are recursive observations, not an authoritative zone audit.

Verification after remediation Repeat the DNS checks after propagation and verify delivery from every legitimate mail sender.

Method We compare public Microsoft realm and OpenID responses, Autodiscover DNS and selected Azure DNS links.

What the result means Public tenant metadata identifies the service footprint. It does not prove a weakness in tenant access controls.

Scope and limitations No tenant login, MFA, Conditional Access or internal Azure configuration is tested. A confirmed absent tenant is excluded from scoring.

Verification after remediation Verify tenant ownership and internal controls with the administrator; repeat public discovery after DNS changes.

Method We connect on port 443 with SNI and certificate verification, record the negotiated protocol and certificate expiry, and try www when the apex connection is unavailable.

What the result means Certificate validation failures or approaching expiry can disrupt trusted HTTPS access. Renewal findings use thresholds below 14 and 30 days.

Scope and limitations One negotiated connection does not enumerate all supported protocols or weak ciphers. HSTS preload and the complete TLS configuration are not tested.

Verification after remediation Repeat the verified connection to the same hostname after renewal or configuration changes.

Method We inspect six security headers on the final successful HTTP response, trying HTTPS, www and HTTP as needed. CSP frame-ancestors can satisfy the framing protection check.

What the result means Missing headers remove browser protections but do not by themselves demonstrate an exploitable application vulnerability.

Scope and limitations Results describe the measured response, not every page or authenticated flow. Restricted responses do not establish missing-header findings. Header presence is not a full policy audit.

Verification after remediation Deploy CSP in report-only mode first, test forms and integrations, then enforce the policy and repeat the same URL check.

Method We attempt TCP connections to 37 ports on up to four public DNS addresses and combine these observations with available Shodan records. Banners are read passively and are bounded.

What the result means Public database or administration ports deserve access-control review. An open SSH port alone is informational. A CVE from a provider requires asset and patch verification.

Scope and limitations No passwords, exploits, UDP sweep or full port scan are used. DNS addresses may belong to a CDN or shared host. Provider observation time can precede this scan.

Verification after remediation Confirm asset ownership, restrict unnecessary exposure, verify vendor patch applicability and repeat the same endpoint checks.

Method We combine certificate transparency sources, public host records and a bounded set of DNS prefixes. The displayed inventory is limited to 100 names.

What the result means A larger public inventory calls for ownership and lifecycle review; it does not prove that a subdomain is compromised.

Scope and limitations Certificate names can be historical. A listed name does not establish a live service or an exhaustive asset inventory.

Verification after remediation Confirm ownership and current DNS and service status before retiring any asset.

Method We query the provider for domain-related credential exposure, keeping employee, customer and third-party groups and approximate counts separate.

What the result means Reported account exposure requires investigation, credential revocation where applicable and review of authentication controls.

Scope and limitations Coverage is limited to the provider database. A negative response means no records were detected in that checked source, not a guarantee that no leak exists. Passwords are not retrieved.

Verification after remediation Verify affected account groups with the owner, revoke exposed credentials and confirm MFA and session controls.

Method We query configured VirusTotal and URLhaus sources and compare Cloudflare malware-filtered DNS with unfiltered DNS.

What the result means Threat classifications can affect access and reputation. They are investigation signals, not proof of a successful compromise.

Scope and limitations Results apply to checked sources at the recorded time. DNS filtering is not a content scan. An unavailable source cannot confirm a clean result.

Verification after remediation Investigate the affected site and DNS, address confirmed issues and request a provider review if the classification is incorrect.