Inventory the surface
Build a searchable portfolio of publicly discoverable hosts, addresses and CNAME targets tied back to each monitored domain.
External attack surface + security posture
Surface Map · 14-control posture · Continuous Monitor
See what is exposed.
Know when it changes.
DomainGuard gives MSPs and security teams an outside-in view of every managed domain: public surface mapping, a 14-control security posture score, scheduled rescans, drift history, prioritized findings, and client-ready reporting across TLS, web security, email authentication, DNSSEC, and mail transport.
14Posture controls
SURFACEPublic host map
MSPPortfolio monitoring
POSTURE SCORE84/100
B
PASSTLS certificate20 / 20
PASSDMARC15 / 15
PASSSPF10 / 10
FIXMTA-STS0 / 5
FIXDNSSEC0 / 5
MAPPublic surface8 hosts
Surface map + posture evidence + remediation returned as JSON
Built forMSPsSecurity teamsWebsite agenciesCompliance toolingSaaS onboarding
Live demo
Scan a public domain now.
Try the same posture engine behind the API. The website demo is intentionally limited to three scans per IP per hour.
Public, non-invasive configuration checks only.
POSTURE SCORE—
—
PUBLIC SURFACE MAP
0 hosts · 0 public IPs
Top remediation items
External exposure operations
Not another score. An exception-driven workflow.
DomainGuard turns bounded public discovery and posture evidence into a daily operating view: what exists, what changed, what matters most, and what to fix next.
Prioritize the risk
Rank failed controls by severity and domain posture so operators work the highest-impact exceptions first.
Explain the change
Show before-and-after configuration drift, control transitions, certificate thresholds and public-surface additions or removals.
Close the loop
Give the operator exact remediation, history, signed webhook delivery and plan-aware client reporting instead of another raw scan dump.
Coverage
Check the controls people forget until something breaks.
DomainGuard performs external, non-invasive configuration checks and turns them into a result developers can consume without stitching together multiple DNS, TLS and header tools.
TLS & certificates
Certificate validation, protocol details and remaining certificate lifetime.
Email authentication
SPF and DMARC presence, plus MX configuration for mail receiving posture.
Transport policy
MTA-STS and SMTP TLS reporting checks for stronger mail-transport visibility.
Security headers
HSTS, CSP, MIME sniffing, clickjacking, referrer and browser-permission controls.
DNSSEC
DS-record detection to identify whether DNSSEC is published at the delegation.
Public surface map
Bounded DNS and certificate discovery for public hosts, addresses, nameservers, mail exchangers and certificate names.
Actionable output
0–100 score, surface evidence, control-level findings and remediation notes in one JSON response.
Developer first
A small endpoint that fits into bigger workflows.
Use DomainGuard in customer onboarding, MSP assessments, website QA, compliance evidence collection, vendor reviews, or security dashboards.
- REST / JSON
- OpenAPI 3.0 definition
- Short-lived result cache for efficient repeated checks
- Protected API routing
- Concurrency safeguards for consistent service quality
GET /api/public/domain-audit/example.com
{
"service": "Zeah DomainGuard",
"domain": "example.com",
"score": 92,
"grade": "A",
"summary": "12/14 controls passed",
"surface": {
"host_count": 8,
"public_ip_count": 12,
"hosts": [...]
},
"checks": [
{
"name": "DMARC",
"pass": true,
"points": 15
}
],
"recommendations": [...]
}Continuous monitoring
Know when your external security posture changes.
DomainGuard Monitor saves a baseline for every enrolled domain, rescans on schedule, keeps history, and records meaningful drift across public hosts, certificates, SPF, DMARC, MX, DNSSEC, mail transport and web security controls.
- Multi-domain MSP and customer workspace
- Priority queue for failed controls
- Discovered public asset inventory
- Automatic rescans with score history
- Failure, recovery, and surface-drift detection
- White-label printable reports and CSV export
- Signed HTTPS webhook delivery for PSA/automation workflows
PREVIOUS SCORE91/100
A
DRIFTDMARC policychanged
ALERTCertificate lifetime14 days
NEWPublic hostportal.example.com
OKSPFunchanged
Change event stored · webhook queued
For MSPs
Turn external posture into a managed security service.
DomainGuard is designed to sit behind your service desk: baseline a customer at onboarding, monitor the portfolio continuously, turn failed controls into approved remediation work, verify the fix with a fresh external scan, and give the customer a simple report showing what changed and what was remediated.
Onboarding baseline
Establish the customer’s initial score, public footprint, failed controls, and remediation backlog before changes begin.
Technician priority queue
Bring the highest-impact control failures to the top, then create a guided or staged remediation plan with approval, rollback guidance, and independent verification.
Verified remediation
Track planned → approved → applied → verified work with before/after posture scores and a preserved remediation audit record.
Customer reporting + automation
Generate branded reports and CSV evidence, then use signed webhooks and the Monitor API to feed posture and remediation events into ticketing or automation.
Monitoring plans
One posture engine, scaled for the size of the portfolio.
Every tier uses the same 14-control posture model and Surface Map. Paid plans increase monitored domains, scan frequency, retained history, automation, and MSP reporting capability.
Daily scans · 14-day history · priority queue · asset inventory · guided remediation plans.
Every 6 hours · 90-day history · Remediation Center · signed webhooks · API access.
Hourly scans · 180-day history · remediation workflow · white-label reporting · portfolio operations.
Every 30 minutes · 365-day history · remediation workflow · higher-volume MSP/security-team monitoring.
DomainGuard is an automated external posture assessment and monitoring service, not a penetration test, certification, or compliance attestation. Request access
Efficient by design
Fast, structured results for automated workflows.
DomainGuard performs targeted external checks, uses short-lived caching for repeated requests, and returns structured results that fit cleanly into automation and reporting workflows.
Paid API access uses protected routing and concurrency safeguards to preserve consistent service quality.
Questions
Know exactly what the score means.
Is this a vulnerability scanner?
No. DomainGuard performs public, non-invasive configuration and posture checks. It does not exploit systems or attempt authenticated testing.
Can I use it for compliance?
It can provide useful evidence about specific public controls, but the result is not a certification or compliance attestation.
Why use the API?
Use the same posture data in onboarding, scheduled checks, client dashboards, CI/CD gates, portfolio monitoring, or your own security workflows.
Does Surface Map replace a reconnaissance platform?
No. Surface Map is intentionally bounded to public DNS and TLS/certificate evidence. It is designed to reveal useful external changes without intrusive port scanning or exploitation.
Can an MSP use DomainGuard as a managed service?
Yes. DomainGuard now carries findings through a remediation workflow with explicit approval, rollback guidance, fresh-scan verification, and before/after score evidence. MSP and Scale add white-label portfolio reporting; Pro and above support signed webhook automation.
DomainGuard access