About ZoneAudit
ZoneAudit™ reviews an organisation's internet-facing domains from the outside: DNS records, email authentication, certificates and registration data.
It turns what it finds into a short list of actions, each with an owner, a date and a level: act now, next business day or next review.
An evidence pack records what was found, what was fixed, by whom and when.
Who it is for
Organisations with spread-out domain estates, and suppliers whose customers expect evidence.
Leaders
Each finding arrives as a short action with an owner and a date. A monthly one-page record shows the board what was exposed, what was resolved and what remains.
Engineering and security teams
Each finding keeps its technical detail, from DNS records to certificate chains. The open-source Community Edition CLI runs DNS, TLS, RDAP and HTTP checks against a single domain on your own computer.
Defence suppliers
The MOD has asked defence suppliers to reach Level 0 of its Defence Cyber Certification by 31 December 2026. ZoneAudit covers the internet-facing domain part of that work and sets out what is outstanding.
How it works
Every review follows the same sequence: scan, classify, follow through.
STEP 1
Scan
ZoneAudit maps the subdomains, DNS records, certificates and email authentication it finds across the organisation's domains, including legacy registrations.
STEP 2
Classify
Findings are validated and ranked, then issued with a clear action and owner.
STEP 3
Follow through
Actions are tracked to completion. A later scan confirms each resolution and records the change.
See each step in more detail
The home page shows what ZoneAudit reviews and how each action is followed through.
Principles
How ZoneAudit treats your domains and your data.
Read-only checks
ZoneAudit reads only what is publicly visible and changes nothing on your systems. It needs no passwords or access to your systems for the outside view.
Technical detail
Public DNS answers, RDAP registration data, TLS certificates and HTTP responses, as an outside party sees them. The Community Edition CLI makes one light HTTP(S) request and TLS handshake to each host it discovers; it does not scan ports or attempt access.
Reviewed before it reaches you
A person reviews each access request. Any AI-written explanation of a finding passes an approval gate before it is sent, and changes are proposed first and applied only with your approval.
Evidence you can show an auditor
Each scan, action and approval is recorded with its date and approver. The evidence pack presents this as a single document for auditors, insurers and customers.
Technical detail
ZoneAudit provides evidence for parts of frameworks such as Cyber Essentials, ISO/IEC 27001 and the MOD's Defence Cyber Certification Level 0 (for Level 0, only the internet-facing domain part). It does not certify.
Privacy
To request access we ask for your company, domain, role and work email, confirmed with a one-time code, and never for passwords. A check on a domain you have not verified shows only a general result; the details go to verified owners only.
Technical detail
What is kept is the dated record of scans, actions and approvals that makes up your evidence pack. Personal data is handled under the CobraSphere Privacy Policy.
