How can we help you?

ZeroHook analyzes your domain's DNS records and security configuration in under a minute. Free accounts get 6 core checks; paid tiers and trials run 29 additional checks (35 total) covering email authentication (SPF, DKIM, DMARC), transport security (MTA-STS, TLS-RPT), and infrastructure integrity (DNSSEC, CAA, DANE). You get a score from 0-100 and step-by-step copy-paste fixes for every issue found, tailored to your DNS provider.

Your score is calculated using our proprietary algorithm that weights up to 35 checklist checks (6 on Free) across 5 categories: Email Auth (40%), DNS Security (25%), Transport (20%), Reputation (10%), and Infrastructure (5%). A score >= 90 is an A (Excellent), while below 60 is an F (Critical).

No signup or credit card is required for your first manual audit. You can enter any domain and get an instant security report. We only require an account if you want to enable continuous monitoring, access historical data, or trigger automated remediation alerts. Paid subscription trials require a credit card on file.

From your dashboard, click Add Domain and enter the domain you want watched. ZeroHook runs an initial audit immediately (usually under a minute), then keeps checking it on your plan's schedule and alerts you the moment something drifts, a certificate lapses, or a new blocklist listing appears. Free includes 1 monitored domain; paid tiers scale from 3 to 50.

ZeroHook uses a tier-based subscription model starting at $29/month for Domain Monitor. Annual billing charges 10 months (2 months free), so Domain Monitor is $290/year, Agency/MSP $890/year, and Compliance Evidence Pack $1,990/year, all whole-dollar amounts with no rounding. Paid subscribers get daily on-demand audit limits (25-500/day depending on tier). Tiers also determine how many domains you can put under continuous monitoring.

The Free tier includes 1 monitored domain with weekly 6-check basic scans, plus 3 manual basic audits per day on any domain. Domain Monitor ($29/mo) adds daily 35-check monitoring for up to 3 domains. Agency/MSP ($89/mo) scales to 25 domains with white-label PDFs, CSV export, and Slack/webhooks. Compliance Evidence Pack ($199/mo) scales to 50 domains and adds NIS2/SOC2/ISO compliance reports, Excel export, and tamper-proof verify.

Each paid plan includes a generous daily on-demand audit allowance: Domain Monitor (25/day), Agency/MSP (50/day), Compliance Evidence Pack (100/day), and Enterprise (500/day). Free accounts get 3/day. Limits reset daily.

Upgrades are immediate and prorated (you only pay the difference). Downgrades are scheduled for the end of your current billing cycle so you keep the features you already paid for. All subscriptions are non-refundable per our Terms of Service.

Free tier runs 6 checklist checks (email auth + core DNS) on manual audits and weekly basic scans. Paid tiers run 35 checks: SPF/DKIM/DMARC (full validation, including alignment and forensic reporting), BIMI/VMC, DNSSEC, CAA, MTA-STS, TLS-RPT, DANE, STARTTLS, SSL expiry, zone-transfer risk, nameserver health and diversity, and global blacklist monitoring. Paid scans also show NIS2 readiness indicators; exportable NIS2/SOC2/ISO compliance reports require Compliance Evidence Pack.

Subdomain takeover (an abandoned CNAME still pointing at a service someone else can claim) needs certificate-transparency discovery plus an HTTP probe of every candidate host, which is far slower than a DNS check, so it runs as its own standalone scan rather than inside the 35-check audit. It's an Agency/MSP-and-above entitlement and it lives in monitoring rather than in a one-off audit: add the domain to monitoring and it is scanned daily, with a scan-now button and its own history on the monitor's Threats tab.

Free users get weekly scans. Domain Monitor, Agency/MSP, and Compliance Evidence Pack tiers receive daily automated re-audits of their monitored domains, with lightweight probing in between for faster incident detection. If any record changes or a security gap appears, we send an instant alert via email, Slack, or webhook depending on your tier.

Most tools only check if a record exists. ZeroHook validates the content against RFC specifications and cross-references results across multiple global anycast DNS nodes to prevent false positives and detect configuration drift that others miss. A check that can't complete a probe (a blocked port, no nameserver answer, a rate-limited lookup) is reported as inconclusive rather than marked as passing on data it never measured.

Yes, on Compliance Evidence Pack ($199/mo). Paid scans include NIS2 readiness checks; the Evidence tier adds exportable NIS2/SOC2/ISO compliance PDFs, Excel export of the underlying controls, tamper-proof verify links, and the continuous monitoring history auditors expect for DNS and email authentication under NIS2 Article 21.

For Compliance Evidence Pack users, we maintain a 1-year tamper-proof log of all changes and audit results. Each entry is cryptographically hashed in a chain, so auditors can verify that the security evidence has not been altered retroactively; a public verify link lets them check the chain themselves without a ZeroHook account.

White-label PDF reports (custom logo, brand colors, company name) are available from Agency/MSP ($89/mo) upwards, plus Compliance Evidence Pack and Enterprise. Agency tier also covers multi-domain monitoring, CSV export, and Slack/webhooks. If you outgrow your plan's domain limit, add extra domains for $5/month each on Agency/MSP or $4/month each on Compliance Evidence Pack, or upgrade to the next tier.

Agency/MSP subscribers and above configure branding under Reports → White Label, then download branded PDFs from Audit History or monitoring evidence. Compliance Evidence Pack adds NIS2/SOC2/ISO control mapping, Excel export, and the tamper-proof auditor verify link on top.

For every finding, ZeroHook provides exact TXT/CNAME record values tailored to your specific DNS provider (Cloudflare, GoDaddy, Namecheap, AWS Route 53, and more). When a record already exists, the proposed fix only changes what's needed to close the finding; it never resets a working record back to a generic template. Copy the value, paste it into your provider's dashboard, and the issue is resolved.

We provide step-by-step guides for resolving SPF "too many lookups", DMARC "p=none" warnings, missing DKIM selectors, and DMARC alignment or reporting gaps. When you already have a DMARC record, the fix only adds the missing tag (like rua= reporting) and leaves your existing policy, alignment mode, and forensic reporting untouched. Guides are updated continuously as provider interfaces and security standards evolve.

Yes. Any paid subscription can generate API keys under Dashboard → API Access, with configurable expiration and per-key revocation. Use it to trigger audits, pull monitoring results, and integrate ZeroHook into your own tooling or client dashboards without logging into the UI.

From Dashboard → Integrations, you can connect a Slack webhook for high-fidelity alerts in your #security channel, or a custom webhook to stream monitoring events as JSON to any endpoint you control. Both are self-serve, no support ticket required.

You can add or remove monitored domains directly from your dashboard. If you exceed your tier limit, upgrade to the next tier, or, on Agency/MSP and Compliance Evidence Pack, buy individual domain add-ons ($5/month on Agency/MSP, $4/month on Compliance Evidence Pack). Domain Monitor has no add-on since Agency is already the better deal past 3 domains.

Yes. Enable 2FA under Settings → Security using any TOTP authenticator app (Google Authenticator, Authy, 1Password, etc.). Once enabled, sign-in requires your password plus a 6-digit code from the app.

From Settings → Account, you can request a full data export (audits, settings, and purchase history) or delete your account outright. Exports are rate-limited to one request per 24 hours and arrive by email; account deletion asks you to type a confirmation phrase first since it cannot be undone.

For Enterprise accounts with custom pricing, we support custom invoicing, NET-30/60 terms, and dedicated account management. Self-serve annual billing includes 2 months free (pay for 10 months): $290, $890, and $1,990. Enterprise annual terms are quoted separately.