What is the first thing to fix?

SPF with -all and a DMARC record, even at p=none, stop most spoofing of your domain and start sending you reports. Then move DMARC to quarantine and reject.

We do not send email from this domain. Do we need SPF?

Yes: publish "v=spf1 -all" and a DMARC reject policy so nobody else can send as you.

Why list certificates?

Certificate transparency logs show every certificate issued for your names. Unfamiliar hostnames can reveal forgotten servers or impersonation attempts.

How well is this domain protected?

The checks we run at the start of every engagement: can your domain be spoofed in email, is DNS signed, does the website enforce HTTPS and send protective headers, and which certificates have been issued in your name.

arventiqlabs.com/check-domain

Ten-second demo recorded on this site with sample data: the domains and UPI IDs shown are fictional.

Takes 5–15 seconds; we query DNS, your website and certificate transparency logs. Nothing intrusive — only public records and a normal page request.

Built and maintained by the Arventiq Labs team in Bengaluru. Free for anyone, source on GitHub (MIT). Results are indications, not verdicts. Something wrong? Tell us.