What your public surface tells anyone who looks
Two signals anyone can read without your permission: the DNS that says who may send mail as you, and the headers your homepage returns to every visitor. This reads both and returns them as a short list of prioritized findings — not a checklist score, and not a hundred rows for you to triage.
Check your own domain
Enter a domain. Warden reads its public DNS and requests its homepage once, then returns what it found in priority order — each finding with the observation that produced it and one recommended action. Ranked by reachability, exploitability and business relevance, not by a score.
How the ranking is decided
A finding earns its place by argument, not by a number handed down from a severity table. Three questions decide the order, and each finding says which of them carried it.
- Reachable: can someone act on this from outside, with no access and no credential. A domain that permits anyone to send mail as it is reachable by anybody with a mail server.
- Exploitable: is there a plausible path from the observation to a real consequence, today, without a chain of unlikely conditions. A missing header that only removes a mitigation ranks below one that leaves a session in the clear.
- Business relevance: who carries the loss. Forged mail in your name lands on your customers and your finance team, which is why an absent DMARC record outranks a framing header on a marketing page.
The same three criteria order the findings inside a paid Snapshot. This tool is the automated slice of that method, run on the two signals that can be read without authorization.
Limits, stated plainly
- One hostname. Subdomains, mail-only names and application hosts are not enumerated, and the check does not guess at them.
- Headers from one response. A homepage may be served by a different edge configuration than your application paths, so a clean result here is not a statement about /app or /api.
- No authenticated surface. Nothing behind a login is examined, because nothing behind a login can be examined without authorization.
- No vulnerability testing. Nothing is sent that could change state, and no finding here is evidence that anyone has exploited anything.
- A moment in time. DNS and headers are answers to questions asked at one instant; re-run the check after any change.
Questions this raises
What does this check actually read?
Two public signals. Public DNS: the SPF chain, every include it resolves, and the DMARC record at _dmarc.yourdomain. And one HTTPS GET of your homepage, from which only the response headers are used — transport security, content policy, framing, referrer policy, software banners and cookie attributes. The page body is discarded.
Is this a scan of my systems?
No. It reads DNS that any receiving mail server reads at delivery time, and makes one ordinary request for the homepage the way any visitor's browser does. No ports are probed, no paths are guessed, no payloads are sent and no login is attempted. Warden does not access, scan or investigate anything without agreed scope and explicit written authorization.
Why are the findings not ranked by CVSS?
Most of what this check surfaces has no CVE and therefore no CVSS score — a domain that permits anyone to send mail as it, or a redirect that never became HSTS. Warden ranks by whether a finding is reachable from outside, whether it is plausibly exploitable, and whether it is attached to something the business cares about. Each finding states which of the three carried it.
The check found nothing. Is that useful?
Yes, and it is reported as a result rather than padded. It means email authentication and the homepage response headers are configured the way they should be. It says nothing about authenticated application paths, dependencies or cloud configuration, because those are not readable from outside without authorization.
How is this different from the $299 Security Assessment Snapshot?
This check is automated, instant and limited to two public signals on one hostname. The Snapshot is a bounded engagement against a scope you agree and authorize in writing: it covers more of your public surface, and each finding is investigated rather than read off a header, with a governance note separating the recommendation from the authority to act. One-time, $299, no subscription.
Can I check a domain I do not own?
Technically yes, because everything it reads is public. Publishing findings about someone else's domain is a different matter, and Warden's own rule is that assessment work happens only against a scope its owner has authorized in writing.
Going deeper on one finding
If this check reported an SPF problem, the chain underneath it is worth counting properly: the lookup count against the RFC 7208 limit of 10, and the number of IPv4 addresses the chain authorizes to send as you. The SPF DNS lookup checker runs both and shows every record it read, and the teardown works through a real chain that authorized 1,086,996 addresses, in the order that reduces it without breaking your own mail.