About Certadomain

A free way for anyone to check a domain's security: what it is for and how the checks work.

About Certadomain

Certadomain is a free web service, with no sign-up, for checking the security of a domain. Enter a domain name to inspect the things that are easy to overlook when you run one: email anti-spoofing (SPF, DKIM, DMARC), registration details, DNS configuration, subdomains, phishing signs and look-alike domains.

The goal is that a non-specialist can understand a result and see what to do next. That is why the tools come with a guide (currently in Japanese) and a glossary of the findings that explain how to read results and how to fix them.

Tools

• Domain Overview Check: Email authentication, DNS and registration scored out of 100.
• DMARC / Anti-Spoofing Check: SPF, DKIM, DMARC and MX status, plus the SPF lookup count.
• Phishing Site Check: Domain-name patterns and registration age, scored for phishing traits.
• Subdomain Finder: Lists subdomains from Certificate Transparency logs.
• Subdomain Takeover Scanner: Finds dangling CNAMEs and other takeover-prone records.
• Lookalike Domain Scanner: Finds registered domains that imitate yours.
• DNS Health Check: Nameserver redundancy, DNSSEC and CAA.

How the checks work

Checks use public information only. Nothing is sent to the target's servers other than ordinary DNS and registry queries, and nothing is changed.

• DNS: queries through DNS over HTTPS (Google Public DNS) and directly to authoritative nameservers for SPF, DKIM, DMARC, MX, NS, DNSSEC and CAA records.
• Registration data: RDAP (found through the IANA bootstrap registry) for creation and expiry dates and transfer lock; JPRS WHOIS for .jp domains.
• Certificate Transparency logs: public search services (crt.sh and Cert Spotter) for subdomains.
• Rules: email authentication is evaluated against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC); the phishing check uses our own heuristics on brand names, character substitution and registration age.

What happens to results

• Results are cached briefly so that repeated checks of a domain are fast.
• Only when you press "Create share link" is the result stored for 30 days, viewable by anyone with the link.
• See the Privacy Policy and Terms of Use for details.

Limits of the results

• DKIM selectors can have any name, so a domain may use DKIM even if the tool cannot find it.
• The phishing check is an indication based on the domain name, DNS and registration age. It does not look at the site's content and is neither a guarantee of safety nor a finding of bad intent.
• Registration data is not available for every top-level domain.

Operator