Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
// EXPOSURE CHECK

What does your domain show the internet?

Free external check. Give us your domain and a work email at it, and we'll look at what's visible from the outside, your email authentication, certificate and DNS hygiene, and whether the records you publish give away more than they need to. No access needed, nothing changed, and the report arrives in your inbox within a few minutes. It won't tell you what's happening inside your Microsoft 365 tenant, but it's a useful place to start.

Passive only Nothing changed Report in minutes
RUN THE CHECK

Submitting this opts you in to a short follow-up from Ferres Systems about your results. Every message carries an unsubscribe link and one click is enough.
Ferres Systems, PO Box 338, Geelong VIC 3220. ABN 98 663 151 710. Sent from ferressystems.com.au.

// WHAT WE LOOK AT

Five things, all of them public already

None of this requires permission to look at, which is exactly why it is worth knowing. Anyone considering your business as a target can see the same things today.

01

Email authentication

SPF, DKIM and DMARC as they are actually published, and whether anyone could send mail as you today

02

Certificate authority control

Whether CAA records restrict who may issue certificates for your domain, or whether any authority can

03

DNS posture

Records that expose more than they need to, and the ones quietly left behind by an old supplier

04

Where your domain points

The apex, www, autodiscover and nameserver records, and who is actually handling your mail

05

Transport security

Whether MTA-STS and TLS reporting are published, or whether your mail can be quietly downgraded in transit

WHAT IT WILL NOT TELL YOU

Nothing about the inside of your environment. Not how your Microsoft 365 tenant is configured, not whether your devices are patched, not who has administrative access, and not whether anybody is watching overnight. Those questions need access, and access needs a proper engagement.

See the Security Baseline Assessment
// QUESTIONS, ANSWERED

Before you type your domain in

No. Everything in this check is visible from the outside to anybody who cares to look, which is rather the point. Nothing is installed, nothing is logged into, and nothing is changed.

Because the report is sent to that address. Requiring an inbox at the domain being checked, or a subdomain of it, means the report only reaches someone who can read mail there, which makes the tool much harder to use for profiling somebody else's business. Free mail addresses are refused for the same reason. It is not a check of authority: the form does not verify who you are, that you own the domain, or that you are authorised to act for the business. We will not relax the rule, including for consultants checking a client domain.

No. This shows what is visible externally. It says nothing about what is happening inside your Microsoft 365 tenant, how your devices are configured, or whether anyone is watching. It is a useful place to start, not a verdict.

That is what the Baseline Assessment is for

You get the report, and a short follow-up you can stop with one click. Your details are never sold or shared for marketing. The domain and address are held so we can answer questions about the report later, and deleted on request.