Check a domain for free

You can check a domain without adding it to your account. A check is not added to your watched domains unless you choose to add it. Which domains your account may scan is set by the rule below.

The Scan tab (iOS)

Type a domain and pick a mode:

• Quick scan: DNS, email authentication, registration and the website's security headers. Passive, about 10 seconds, and counted against the plan's daily website-scan allowance.
• Full scan: everything in a quick scan plus certificates, exposed files, attack surface, SEO and accessibility. One per account per hour; the tile counts down to the next one. A full scan of one of your own domains is that domain's Scan now, so its monitoring figures refresh too.

Every scan is saved to the account's history on the Scan tab (and the latest show on the Monitoring tab), so it survives closing the app or changing phones. Remove from history hides one; Quick scan again re-runs it.

Signed out

Check a domain without an account on the welcome screen runs a six-part check that is saved nowhere:

1. DNS & registration
2. SSL certificate
3. Email authentication
4. Security headers & exposure
5. Content & SEO
6. Accessibility

The two on-device checks (Content & SEO, Accessibility) run for anyone. The four server-side checks say "Needs an account", because since 2026-08-26 the server answers 401 to a scan request with no session. The result offers a free account.

The App Clip

https://nhmohio.com/clip?domain=… opens a small version of the app without a download and runs the same check. One completed scan per device; a scan that could not reach the domain does not spend it. Both buttons on the limit screen open the App Store overlay. See The App Clip.

On the website

• Free Email & Domain Security Checkup at nhmohio.com/domain-checkup: SPF, DKIM, DMARC, MX and nameservers, with provider-specific steps for Microsoft 365 and Google Workspace. It asks you to sign in or create a free account before it shows the report.
• Website & Domain Report and the single checkers (SPF, DMARC, SSL, headers, DNS, blacklist) at nhmohio.com/tools: the same quick scan as the app, from a signed-in session.
• Lookalike domain check at nhmohio.com/lookalike-domain-check: generates up to 100 variations of your domain and checks which are registered, paying most attention to whether one can receive mail. This one is public and needs no account, because it reads DNS, RDAP and certificate logs and never touches the other party's server.
• Free IT checkup, the password checker and the phishing quiz are listed there too.

Which domains you can scan

Basic scans work on any domain. They read what a site already shows everyone: DNS, email records, certificates, headers and pages.

Deep scans run on domains you verify. They test open ports, look for known vulnerabilities and probe for exposed files, so they need proof the domain is yours, one domain at a time:

1. Your verified sign-in email is at it. Signing in as you@yourcompany.com already counts for yourcompany.com and its subdomains. A free or ISP mailbox, Apple's Hide My Email relay, a disposable inbox, or a school or government address does not.
2. You verified it with an email link, a DNS record or a file, about a minute. Open the domain and tap Verify you own it; we finish the check on our own and tell you in Alerts.
3. We approved your account for deep scans of any domain, for people who look after sites they can't verify. Ask in the app under Account, Scan access, or over the API with POST /api/scan-access/request; the decision arrives in your Alerts feed.

A deep scan of a domain that isn't verified answers 403 domain_verification_required and the app offers to verify it. The details are in Verifying a domain for deep scans.

Why scanning needs an account

Each check runs real DNS lookups, TLS handshakes and page fetches. Scanning from the website and the app stays free; it just is not anonymous, and deep scans are limited to domains you verify. Scripted access (the API and MCP) needs Pro or higher.

Domains the public tools refuse

The public and add-time checks will not scan major banks, government and military domains (.gov, .mil, .int, .edu), and the largest platforms, retailers, telecoms, airlines, insurers and media sites. A customer who genuinely owns one of those proves it per domain (DNS record, file, or an email at that domain) and the block lifts for that domain only. See Verifying a domain for deep scans.