How does ZeroHook verify my domain security?

ZeroHook performs a tiered security audit: 6 checklist checks on Free and 35 on paid tiers, covering DMARC, SPF, DKIM, DNSSEC, MX records, SSL/TLS certificates, CAA records, BIMI, email routing, and DNS configuration.

How long does a scan take?

Most scans complete in under 60 seconds with real-time progress updates.

What is NIS2 compliance?

NIS2 is the EU's Network and Information Security Directive. Our reports help identify DNS security gaps and provide audit-ready documentation.

Solutions

One scan engine. Four different jobs.

Whether you run one domain or manage two hundred client domains, ZeroHook reads the same thirty-five checks and hands back the same copy-paste fixes. What changes is who sees them, and how the report is branded.

SaaS & e-commerce

Fix your deliverability in five minutes.

Password resets and receipts are landing in spam. We check SPF, DKIM, DMARC and BIMI in under sixty seconds, and hand you the exact record to paste for Cloudflare, Route 53, GoDaddy or Namecheap.

60-second auditCopy-paste fixesDaily monitoring

Deliverability scan

northwind-logistics.com

Checking SPF, DKIM, DMARC, BIMI…

SPF
DKIM
DMARC
BIMI

No DMARC record published. Anyone can spoof this domain and receiving servers have no policy to apply.

Current

Not present

TXT · _dmarc

v=DMARC1; p=none; rua=mailto:[email protected]; pct=100

Paste it at

Cloudflare

dash.cloudflare.com › DNS › Add record › TXT · _dmarc

Client portfolio

ZeroHook

northwind-logistics.com
just now68
harbourpoint-dental.com
47m ago91
vellum-partners.co
3h ago74
orchard-supply.net
1d ago43

+21 more domains on this plan

Export

Domain, Date (UTC), Executed by, Auth method, Result (score / risk)

zerohook-audit-history-2026-01-01.csv

Agencies

Ship the report with the site.

Run a scan at handover and every client domain lands in one Audit History. From the Agency plan up, brand the PDF with your own logo and colors, so the deliverable reads as yours, not ours.

White-label PDFs25 client domainsCSV export

MSPs

Know before your client does.

A probe every fifteen minutes catches the SPF break, the dropped DMARC policy, the cert nearing expiry. Alerts route to Slack, email or a webhook, so you respond before the ticket lands.

15-min samplingSlack & webhook alertsQBR-ready PDFs

Alert delivery

every 15 min

Change detected on northwind-logistics.com

DNS Configuration Changed

DNS records for northwind-logistics.com have changed: TXT records changed (+1/-1)

Severity: Medium
Domain: northwind-logistics.com

Slack
Email
Webhook

POST body

{
  "id": "212090ae-a62f-4dd4-8953-d485512e2232",
  "timestamp": "2026-01-01T00:00:00.000Z",
  "type": "alert",
  "userId": "471f3490-1884-49a8-aaa5-a74ad36e330c",
  "data": {
    "title": "DNS Configuration Changed",
    "message": "DNS records for northwind-logistics.com have changed: TXT records changed (+1/-1)",
    "severity": "Medium",
    "domain": "northwind-logistics.com"
  }
}

Enterprise

readiness

Already wired

Domains: Unlimited
Team seats: Unlimited
History retention: Unlimited
Audits: 500/ day
API requests: 10,000/ hour
Deep takeover scans: 50/ day

Tamper-proof evidence chain
White-label reports
CSV and Excel export
Slack and webhook alerts

In development

SSO
SIEM integrations
Custom compliance mappings
Dedicated manager

Enterprise

Coming soon.

SSO, SIEM integrations, custom compliance mappings and a dedicated manager for organizations running 100+ domains. In development while we focus on getting the SMB experience right.

Contact sales

Find the plan for your job.

Six checks free, no account. Full scans and monitoring start at $29 a month, two months free on annual.

Run a free scan See pricing