Know which
domain risks
need action today
ZoneAudit™ checks your domains, DNS records, certificates and email authentication.
Every finding gets a deadline: act now, act by the next business day, or leave it for the next scheduled review.
Each one goes by email to the people who own the decision. Microsoft Teams and Slack are in early access.
Teams and Slack delivery and continuous watching are on the roadmap. They are marked "Early access" where they appear further down.
What leadership receives
ZoneAudit is designed for decision-makers. Each finding arrives as a short action with an owner and a date, and progress is reported monthly. It is designed for large, decentralised DNS estates and sends only what needs a decision.
Written to read in 3 seconds
The action
One sentence that states the exposure and the action required, classified as act now, next business day or next review.
1 owner per action
An owner for every action
Each action has a named owner and a date. A later scan confirms when it has been resolved.
12 reports a year
A monthly before-and-after
A one-page record for the board of what was exposed, what was resolved and what remains.
Every business unit
An executive view across business units Coming later
Domain exposure, decisions and progress across every business unit, for leadership.
How it works
Every review follows the same sequence: scan, classify, follow through.
STEP 1
Scan
ZoneAudit maps the subdomains, DNS records, certificates and email authentication it finds across the organisation's domains, including legacy registrations.
STEP 2
Classify
Findings are validated and ranked, then issued with a clear action and owner.
STEP 3
Follow through
Actions are tracked to completion. A later scan confirms each resolution and records the change.
What ZoneAudit reviews
The review covers records and services that sit outside day-to-day change control.
Forgotten subdomains, misconfigured records and expired services are easy to miss, because nobody changes them day to day.
From audit preparation to routine review, ZoneAudit shows what exists, where it points and what no longer belongs.
Where your domains point
The records we find for your domains, checked against what should be there.
Technical detail
DNS records (A, AAAA, CNAME, MX, NS, TXT, SOA) and nameserver delegation from the parent zone. Public DNS does not list every record, so the review covers the names it can discover and the names you give it.
Who can send mail as you
Gaps that let others send mail that appears to come from your domain.
Technical detail
Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and DMARC records, checked for presence, syntax and policy (none, quarantine or reject).
Certificates
Expiry dates and set-up on the sites we find serving traffic.
Technical detail
Transport Layer Security (TLS) certificates, checked for expiry date, issuer, name match and certificate chain.
Forgotten subdomains
Addresses still pointing at services that no longer exist.
Technical detail
Dangling CNAME, A and AAAA records that point at retired hosts or cloud services. Someone else could claim the service and take over the address (subdomain takeover).
Exposure from the outside
What your domains show to anyone on the internet.
Technical detail
Public DNS answers, registration data from the Registration Data Access Protocol (RDAP) and HTTP responses, as an outside party sees them.
Domain sprawl
Overlapping domains and zones that nobody manages.
Technical detail
Registrations and zones compared by registrar, nameservers and RDAP registration data, to find domains outside known ownership.
Changes to who controls your domains
Unexpected changes to where your domains are registered or served from.
Technical detail
Nameserver (NS) delegation, registrar and registration status from RDAP, compared between scans.
Change detection
Each scan compared with the one before, reporting what has changed.
Technical detail
Record-level differences between consecutive scan results.
- _dmarc.example.com · TXTAct now
Averts: mail spoofed from your domain reaching inboxes
- legacy-mail.example.com · CNAMEAct nowCurrentmail-old.retired-host.example.netProposed(remove record)
Averts: someone else taking over a retired address and receiving your mail
- example.com · CAANext reviewCurrent(no record)Proposed0 issue "letsencrypt.org"
Averts: certificates for your domain issued by an authority you do not use
Where a finding has a defined remediation, such as a missing DMARC record or an obsolete CNAME, ZoneAudit drafts the exact change and says what it averts.
Changes are applied only after approval by an authorised person, and are confirmed on the next scan.
ZoneAudit Evidence Pack
- Act now
legacy-mail.example.com still points to a server that was retired. Anyone who takes over that address could receive your mail.
- Owner
- Mail administrator
- Due
- 6 Oct 2026
- Next business day
billing.example.com has DMARC set to 'none', so mail pretending to be your billing team isn't blocked.
- Owner
- Finance systems lead
- Due
- 7 Oct 2026
- Next business day
The certificate on portal.example.com expires in 9 days.
- Owner
- Web platform team
- Due
- 7 Oct 2026
Need proof for an auditor or insurer?
The evidence pack can be exported whenever it is asked for.
The Ministry of Defence has asked defence suppliers to reach Level 0 of its Defence Cyber Certification by 31 December 2026 (MOD Defence Digital blog, July 2026). The ZoneAudit review covers the internet-facing domain part of that work and sets out what is outstanding.
$ zoneaudit -d acme-example.com Scanning acme-example.com... [OK] SPF record present [WARN] DMARC record missing [WARN] 2 subdomains point to unclaimed services Done in 4.2s
curl -fsSL https://zoneaudit.com/install.sh | shResponsible use: only scan domains you own or are authorised to test.
Installs the latest release to ~/.local/bin, for x86-64 or ARM64. Read the script first.
Designed for demanding environments
ZoneAudit supports organisations where domain infrastructure carries safety, compliance or contractual weight.
Engineering
Distributed sites and legacy domains under one review.
Manufacturing
Operational and corporate domains assessed together.
Automotive
Supplier and dealer subdomains brought into view.
Aviation
Exposure recorded in a form that can be evidenced.
Defence supply chain
Readiness for Level 0 and contractual cyber requirements.
Agriculture and robotics
Connected machines and supplier domains, reviewed from the outside.
Request access
Tell us your company, domain and role, and confirm your work email with a one-time code.
Each request is reviewed by a person. Approved companies receive an access code that opens their own ZoneAudit snapshot. If it is not yet possible, we say so.
Access is by request. ZoneAudit shows where an organisation is exposed, so we confirm you represent the domains before anything is shown.
ZoneAudit access
We send a one-time code to this address.
For more information on how CobraSphere manages, uses, and protects your information please refer to the CobraSphere Privacy Policy.
Select a name to see what ZoneAudit contributes. ZoneAudit does not certify you; it provides evidence for part of the work.
Questions and answers
Short answers to the questions people ask before they request access.