ToolsDomain check
Domain check.
Seven of the email and DNS checks DarkRisk runs on every vendor, live, on any domain. Lookups go from your browser straight to Cloudflare’s public DNS resolver. DarkRisk never sees what you type.
Or try . Lookups go from your browser to Cloudflare’s public DNS resolver. DarkRisk never sees what you type.
What each check means.
Mail servers (MX)
Where a domain receives email. Recognising the provider tells you who else is part of the picture, and a domain with no mail servers should say so explicitly.
SPF
A list of the servers allowed to send email for the domain. A strict rule (-all) tells receivers to reject everything else. A soft or missing rule leaves room for impersonation.
DMARC
Tells receivers what to do with mail that fails SPF and DKIM checks: nothing, send it to spam, or reject it. A policy of none only reports; forged mail still arrives.
DNSSEC
Signs DNS answers so they can't be forged on the way to users. Without it, someone in the path can point visitors and mail to the wrong place.
CAA
Names the certificate authorities allowed to issue certificates for the domain, which narrows who could be tricked into issuing one.
MTA-STS and TLS reporting
MTA-STS makes other mail servers use verified encryption when delivering to the domain. TLS reporting tells the owner when that fails.
This is a slice of one module. A DarkRisk scan covers twelve, including open ports, certificates, platform versions, cloud storage, breach intelligence and press coverage, and keeps checking. See the platform