Check what anyonecan see about your domain.
Three reports from our network against public records and live connections, and a reader for any mail's headers that runs in your browser. No account, nothing stored. Results state plainly what could not be tested. No guessing.
Mail
SPF, DKIM, DMARC, MTA-STS, TLS
Does your mail arrive and prove its origin? Routing, alignment records, MTA-STS over HTTPS, a live STARTTLS handshake, certificates, and Spamhaus listing for the sending server.
LiveRun the checkWeb security
Headers, CSP, TLS, cookies
What your site tells browsers about its security. Transport, certificates, security headers, Content-Security-Policy quality, cookie flags, and content integrity.
LiveRun the checkDNS hygiene
NS, CAA, SOA, wildcards
Is the zone underneath sound? Name server redundancy, CAA records for certificate issuers, SOA timers, and whether unknown subdomains answer when they should not.
LiveRun the checkHeader reader
Route, SPF, DKIM, DMARC, Reply-To
Got a mail you are not sure about? Paste its headers to see where it really came from, what your provider concluded, and the tricks worth a second look. Read in your browser; nothing is sent.
LiveRun the check
Asked often
Can ChatGPT or Claude run these checks for me?
Yes. Fyzno publishes a Model Context Protocol server at https://fyzno.com/mcp, which lets an assistant run a check itself and read the result rather than being told about it. In Claude: Settings, then Connectors, then Add custom connector, and paste that URL. In ChatGPT: Settings, then Connectors, and add the same URL as an MCP server. You add it once, and afterwards you can ask in any conversation, for example: check the mail setup for example.com. Custom connectors are a paid-plan feature on both, and neither can add one on your behalf.
What can the assistant actually do once it is connected?
Read-only tools, one per report and one per individual finding. It can run the whole mail report, or ask for SPF alone; the same for the web and DNS reports. It can also read this site's live status, its public facts and its page index. Nothing writes, no tool accepts a URL, and the only input any of them takes is a domain name.
Is it safe to connect an assistant to it?
It is read-only and public. Every tool returns something any visitor to this site could already read, so connecting it grants an assistant no access to your systems, your mail or your account, and there is nothing for it to change. Judge any connector on those three questions: what can it read, what can it change, and who sees the result. Here the answers are public information, nothing, and only you.
Do I need to install anything to use it with a local tool?
No. For editors and desktop apps that run tools locally, such as Claude Code, Claude Desktop, Cursor, Windsurf or Zed, add a server with the command npx and the arguments -y @fyzno/mcp, and it fetches on first use. The package has no dependencies at all: one file, about 20 KB, and installing it pulls nothing else onto your machine. The hosted URL is for assistants in a browser, which cannot run a local process. Both routes return identical results.
Are these checks free, and is anything stored?
Free, with no account and no trial. A domain you check goes to our resolver and, for the web check, to your own server. A finished report is held in memory for fifteen minutes so that checking twice costs nothing, and it is gone after that or at the next deploy. Nothing is written to disk and nothing is logged against you.
Why does a report say something was not tested?
Because it could not be answered honestly from our network, and saying so is more useful than guessing. Two examples: TLS 1.0 support cannot be probed because the runtime has those protocols compiled out, so a refusal would be ours rather than your server's; and DNSSEC needs record types this runtime does not expose, so verifying it would mean presenting another resolver's verdict as our own. A section marked not tested scores nothing, rather than being counted as a pass.
Send a brief. A person reads it.
Tell us what you are running today and what you want it to do instead. You get a personal reply with a price that fits, and if it does not, we work out a plan together. The person who writes to you is the same one who would do the work.
Mon–Fri 08:30–23:00 · Sat–Sun 11:00–00:00 CETReply the same day, 48 hours at most. S/MIME-signed.