WORKING DOMAIN TOOLS · TRANSPARENT ROADMAP
Run the public domain score and use 11 local DNS and email-security generators on this website now. The 48-tool catalog makes the next diagnostics visible without treating unfinished tools as available or routing anyone into the product application.
ANSWER-FIRST PROSPECT CONTEXT
MSP prospect risk intelligence combines legitimate public company context with source-labeled external security evidence so a managed service provider can prioritize research, explain why a conversation may matter now, and prepare better discovery questions without claiming purchase intent.
The free public review can observe supported email-authentication records, DNS trust, certificate authorization, authoritative delegation, selected web-response protections, and the security-contact path. It cannot establish internal identity, applications, devices, recovery, people, or operational controls.
No. It is a bounded outside-in observation with visible coverage and unknowns. SCOUTz uses it to support a useful question and an evidence-backed first conversation, not to declare an organization secure, insecure, or ready to buy.
ON-SITE MSP TOOL CATALOG
The public score and local record generators live on this website. The catalog shows the next five diagnostics before the wider planned set, and never sends visitors to an unfinished product route.
AVAILABLE NOW
Prepare a local draft, then let the MSP validate, approve, publish, and verify the change.
Build one sender policy from approved services, hosts, and IP ranges.
Generate a 2048-bit key pair in the browser or format a provider public key.
Stage monitoring, quarantine, and reject with reporting and alignment controls.
Create the DNS marker and hosted TLS policy for the exact inbound mail routes.
Build the brand record and validate its DMARC, logo, and certificate prerequisites.
Route SMTP transport-failure reports to monitored mail or HTTPS destinations.
Authorize normal and wildcard certificate issuers and an incident contact.
Build a certificate association for the right service, port, and DNSSEC-backed host.
Produce deployment-ready browser protection headers for common web servers.
Create a report-first CSP baseline and narrow it using observed application needs.
Publish an RFC 9116 disclosure contact with a monitored address and current expiry.
BUILDING NEXT
DNS, registration, DNSSEC, DMARC, and web-protection checks are the next diagnostic surfaces planned for this website.
Read common and advanced record types without turning a failed lookup into absence.
Distinguish published signing data from a fully validating parent-to-zone chain.
Review registrar, dates, status codes, and redaction through modern RDAP.
Validate policy, alignment, reporting, subdomain behavior, percentage, and rollout state.
Inspect browser defenses and cookie or resource behavior on the final response.
SCOUTz only labels a utility available when it works on this public website and has a truthful evidence boundary. Authorized, infrastructure-dependent, and deeper diagnostic workflows remain visible as the roadmap—but they do not point to unfinished application routes.
Review a prospect or client domain for public-facing email, DNS, certificate, web, and security-contact evidence. Every pass, gap, unread source, and scoring boundary stays visible. The result is free on screen; a business email is only required for the downloadable PDF.
A useful first look for the conversation ahead—not a claim about controls hidden inside the business.
SPF and DMARC presence, policy strength, and visible configuration.
DNSKEY and DS reads to determine whether the DNSSEC chain is published.
CAA records that name which certificate authorities may issue.
Authoritative nameserver delegation and observable redundancy.
One bounded HTTPS homepage read for supported security headers.
The RFC 9116 /.well-known/security.txt contact path.
The current domain-security workflow schedules 23 collector engines across the areas below, contributing to a platform registry of 156 distinct check types. A collector can execute multiple atomic checks and return evidence, no finding, an unavailable source, or an error; SCOUTz records that distinction instead of turning missing coverage into a pass.
DNS depth, certificate health, SPF, DMARC, DKIM signals, MTA-STS, TLS-RPT, DNSSEC, CAA, delegation, reputation, and IPv6 mail-path context.
Subdomains, takeover signals, TLS posture, response headers, website compliance, CMS and technology fingerprints, and public-facing hardening context.
Lookalike domains, impersonation signals, source-labeled historical breach associations, passive perimeter intelligence, and supported public-exposure evidence.
Public Microsoft 365 tenant discovery, managed-versus-federated identity signals, and the evidence boundary for requesting a customer-approved cloud review.
Hosting, email-security, SaaS, telecom/UC, platform, vendor, and incumbent-management signals derived from public records and fingerprints.
Firmographic, entity, mobile-app, digital-presence, compliance-readiness, and public AI-governance signals that help an MSP prepare the right conversation.
MSP SELLER
Use the score and its explicit coverage as a reason to ask a useful question instead of a claim that the organization is insecure or shopping for an MSP.
MSP OPERATOR
Use the local fix lab to prepare the draft, rollout notes, rollback boundary, and final validation plan for an authorized MSP-managed client.
Prepare an MSP-managed client change and preserve the rollout boundary. Everything here runs locally in the browser: no domain query, no scan, no monitoring, no DNS change, and no data sent to SCOUTz.
v=spf1 include:spf.protection.outlook.com -all
Inventory every legitimate sender before publishing -all.
THE ON-SITE TOOLKIT
The public score explains what bounded evidence supports. The local fix lab prepares safe drafts. The larger diagnostic catalog stays visible without pretending unfinished tools are available.
A bounded, factual domain-configuration review with visible coverage and unknowns.
Copy-ready drafts stay in the browser until the MSP validates, approves, publishes, and verifies the change.
The highest-value public checks are visible before the wider planned catalog.
Deeper passive, browser, authorized, and infrastructure-dependent diagnostics stay clearly labeled.
A useful first finding should come with a safe next step. Public and local tools help an MSP teach and prepare; active tests keep customer consent explicit. These utilities remain independent from completed assessment scores.
THE SCOUTz EVIDENCE JOURNEY
Each layer answers a larger question without pretending the earlier layer saw more than it did.
Fourteen bounded public reads become seven scored components plus a source-labeled record appendix with a visible evidence boundary.
Run the courtesy score →Choose from 48 tools, including 11 local generators, browser analyzers, passive checks, and customer-approved active tests.
Find the right tool →Build a broader, source-labeled Domain Review with MSP-ready evidence and reporting.
Explore full SCOUTz →With customer consent, move into a read-only Microsoft 365 review. Permission, license, provider, source, and collector gaps remain visible instead of being counted as clean.
See the cloud review →The score uses public DNS, authoritative delegation, one bounded HTTPS homepage read, and the RFC 9116 security-contact path. It does not use tenant evidence, a port sweep, bulk scanning, history, monitoring, exploitation, or production changes. Unread evidence is excluded and never counted as clean. Think clipboard and flashlight, not an RMM wearing a fake mustache.
Continue the evidence journey in Open Beta →SCOUTz OPEN BETA
Bring a real MSP workflow and see how SCOUTz turns evidence into the next defensible action. The review runs without an agent or install and never changes configuration automatically.
SCOUTz prepares the conversation. The relationship and the sale stay yours.