Is your email and website set up to resist impersonation?
Enter your domain and the Commons runs passive checks that need no access and no permission: public DNS records, your site's HTTPS behavior, response headers, and certificate dates. It never scans ports or probes systems.
Only check domains you own or are authorized to check. Results are cached for an hour.
What the check looks at
SPF record
Tells receiving mail servers which systems may send email for your domain. Missing SPF makes impersonation easy.
Fix: Publish a TXT record listing your mail provider; end it with -all once you are confident.
DKIM signing
Cryptographically signs your outbound mail so forged messages fail.
Fix: Turn on DKIM in your mail provider and publish its selector record.
DMARC policy
Tells receivers what to do with mail that fails SPF and DKIM, and sends you reports. The single biggest defense against invoice and executive impersonation fraud.
Fix: Start with p=none and reporting, move to quarantine, then reject.
HTTPS and redirect
Your site should force encrypted connections.
Fix: Redirect http to https and enable HSTS.
Security headers
Headers such as Content-Security-Policy and X-Frame-Options reduce common web attacks.
Fix: Add the headers through your host or CDN; test after each change.
Certificate expiry
An expired certificate takes your site down and looks like a breach.
Fix: Turn on automatic renewal; set a calendar reminder 30 days before expiry.
Exposed DNS records
Old records can point to services you no longer control (subdomain takeover).
Fix: Remove records for services you no longer use.