WORKING DOMAIN TOOLS · TRANSPARENT ROADMAP
Run the public domain score and use 11 local DNS and email-security generators on this website now. The 48-tool catalog makes the next diagnostics visible without treating unfinished tools as available or routing anyone into the product application.
EVIDENCE · INSIGHT · PROOF
Published SPF, DKIM and DMARC evidence.
Selected published configuration and records.
Supported public observations, with their dates and limits.
Not established by public evidence. Ask for approved read-only access.
EVIDENCE · INSIGHT · PROOF
Published domain, DNS, email authentication, certificates and external evidence.
Supported Microsoft 365 identity, app, permission, licensing and configuration evidence.
No message bodies, private files, chats or prompts. Unread is not clean.
ANSWER-FIRST PROSPECT CONTEXT
MSP prospect risk intelligence combines legitimate public company context with source-labeled external security evidence so a managed service provider can prioritize research, explain why a conversation may matter now, and prepare better discovery questions without claiming purchase intent.
The free public review can observe supported email-authentication records, DNS trust, certificate authorization, authoritative delegation, selected web-response protections, and the security-contact path. It cannot establish internal identity, applications, devices, recovery, people, or operational controls.
No. It is a bounded outside-in observation with visible coverage and unknowns. SCOUTz uses it to support a useful question and an evidence-backed first conversation, not to declare an organization secure, insecure, or ready to buy.
ON-SITE MSP TOOL CATALOG
The public score and local record generators live on this website. The catalog shows the next five diagnostics before the wider planned set, and never sends visitors to an unfinished product route.
AVAILABLE NOW
Prepare a local draft, then let the MSP validate, approve, publish, and verify the change.
Build one sender policy from approved services, hosts, and IP ranges.
Format a DNS record using the public key supplied by your email provider. This tool does not generate signing keys or verify live DKIM.
Stage monitoring, quarantine, and reject with reporting and alignment controls.
Create the DNS marker and hosted TLS policy for the exact inbound mail routes.
Prepare a BIMI record draft. Validate DMARC enforcement, logo format and provider requirements separately before publishing.
Route SMTP transport-failure reports to monitored mail or HTTPS destinations.
Authorize normal and wildcard certificate issuers and an incident contact.
Build a certificate association for the right service, port, and DNSSEC-backed host.
Produce deployment-ready browser protection headers for common web servers.
Create a report-first CSP baseline and narrow it using observed application needs.
Publish an RFC 9116 disclosure contact with a monitored address and current expiry.
BUILDING NEXT
DNS, registration, DNSSEC, DMARC, and web-protection checks are the next diagnostic surfaces planned for this website.
Read common and advanced record types without turning a failed lookup into absence.
Distinguish published signing data from a fully validating parent-to-zone chain.
Review registrar, dates, status codes, and redaction through modern RDAP.
Validate policy, alignment, reporting, subdomain behavior, percentage, and rollout state.
Inspect browser defenses and cookie or resource behavior on the final response.
SCOUTz only labels a utility available when it works on this public website and has a truthful evidence boundary. Authorized, infrastructure-dependent, and deeper diagnostic workflows remain visible as the roadmap—but they do not point to unfinished application routes.
Review a prospect or client domain for public-facing email, DNS, certificate, web, and security-contact evidence. Every pass, gap, unread source, and scoring boundary stays visible. See your free result on screen without entering an email address.
A useful first look for the conversation ahead—not a claim about controls hidden inside the business.
SPF and DMARC presence, policy strength, and visible configuration.
DNSKEY and DS reads to determine whether the DNSSEC chain is published.
CAA records that name which certificate authorities may issue.
Authoritative nameserver delegation and observable redundancy.
One bounded HTTPS homepage read for supported security headers.
The RFC 9116 /.well-known/security.txt contact path.
The current domain-security workflow schedules 35 collectors and can produce 123 distinct finding types. A collector can execute multiple atomic checks and return evidence, no finding, an unavailable source, or an error; SCOUTz records that distinction instead of turning missing coverage into a pass.
DNS depth, certificate health, SPF, DMARC, DKIM signals, MTA-STS, TLS-RPT, DNSSEC, CAA, delegation, reputation, and IPv6 mail-path context.
Subdomains, takeover signals, TLS posture, response headers, website compliance, CMS and technology fingerprints, and public-facing hardening context.
Lookalike domains, impersonation signals, source-labeled historical breach associations, outside-in perimeter context, and supported public-exposure evidence.
Public Microsoft 365 tenant discovery, managed-versus-federated identity signals, and the evidence boundary for requesting a customer-approved cloud review.
Hosting, email-security, SaaS, telecom/UC, platform, vendor, and incumbent-management signals derived from public records and fingerprints.
Firmographic, entity, mobile-app, digital-presence, compliance-readiness, and public AI-governance signals that help an MSP prepare the right conversation.
The free website utility requires an operator attestation. This website safeguard is separate from SCOUTz’s public-source product review. Microsoft 365 reviews require customer-approved, read-only access.
MSP SELLER
Use the score and its explicit coverage as a reason to ask a useful question instead of a claim that the organization is insecure or shopping for an MSP.
MSP OPERATOR
Use the local fix lab to prepare the draft, rollout notes, rollback boundary, and final validation plan for an authorized MSP-managed client.
Prepare an MSP-managed client change and preserve the rollout boundary. Everything here runs locally in the browser: no domain query, no scan, no monitoring, no DNS change, and no data sent to SCOUTz.
v=spf1 include:spf.protection.outlook.com -all
Inventory every legitimate sender before publishing -all.
THE ON-SITE TOOLKIT
The public score explains what bounded evidence supports. The local fix lab prepares safe drafts. The larger catalog stays visible without pretending unfinished tools are available.
A bounded, factual domain-configuration review with visible coverage and unknowns.
Copy-ready drafts stay in the browser until the MSP validates, approves, publishes, and verifies the change.
The highest-value public checks are visible before the wider planned catalog.
Deeper outside-in, browser, authorized, and infrastructure-dependent diagnostics stay clearly labeled.
A useful first finding should come with a safe next step. Public and local tools help an MSP teach and prepare. Customer-approved review begins only when its purpose and access are clear.
THE SCOUTz EVIDENCE JOURNEY
Each layer answers a larger question without pretending the earlier layer saw more than it did.
Scored with a visible evidence boundary.
Run the public score →Draft the rollout notes and rollback plan in the browser.
Open the Domain Fix Lab →Source-labeled evidence for the MSP preparing the meeting.
See the domain review →With customer consent, unknowns stay visible.
See the Microsoft 365 review →The score uses public DNS, authoritative delegation, one bounded HTTPS homepage read, and the RFC 9116 security-contact path. It does not use tenant evidence, a port sweep, bulk scanning, history, monitoring, exploitation, or production changes. Unread evidence is excluded and never counted as clean. It's a clipboard and a flashlight, not an RMM in a fake mustache.
Continue the evidence journey in Open Beta →Bring dated evidence, clear limits, and useful questions.
