# ZoneAudit

> ZoneAudit reviews an organisation's domains from the outside (DNS records, email authentication, certificates and registration data) and turns what it finds into a short list of actions, each with an owner, a date and a level: ACT_NOW, NEXT_BUSINESS_DAY or NEXT_REVIEW. ZoneAudit is a product of CobraSphere Limited, a company registered in England and Wales.

## What it is

- An outside review of an organisation's domains. It reads only what is publicly visible and changes nothing on the organisation's systems.
- Each finding is written in plain English, with an owner, a due date and a level (ACT_NOW, NEXT_BUSINESS_DAY, NEXT_REVIEW).
- Checks cover where domains point, who can send mail as the domain (SPF, DKIM, DMARC), certificates and their expiry, records pointing to retired services, and changes to who controls the domains.
- An evidence pack records what was found, what was fixed, by whom and when.
- Some features are in early access and are marked as such on the site: proposed changes applied on approval, change detection between scans, and Microsoft Teams and Slack delivery.
- ZoneAudit does not certify. It provides evidence for parts of frameworks such as Cyber Essentials, ISO/IEC 27001 and the MOD's Defence Cyber Certification Level 0 (for Level 0, only the internet-facing domain part).

## Who it is for

- Organisations with spread-out domain estates.
- Suppliers whose customers expect evidence, including defence suppliers working towards Level 0.

## Access

- Access is by request: https://zoneaudit.com/en-gb/access?tab=request
- The request asks for company, domain, role and a work email, which is confirmed with a one-time code. A person reviews each request and replies within 24 hours. Approved companies receive an access code. Others are told it is not yet possible.
- The access code opens the company's own ZoneAudit snapshot of its domain: https://zoneaudit.com/en-gb/access?tab=code
- A business that runs a domain can claim it: https://zoneaudit.com/en-gb/access?tab=claim
- To claim a domain, a person with the domain manager role in their business signs in with their CobraSphere account (a one-time code by email, no password), adds the domain and publishes a DNS TXT record at _cobrasphere.<domain> with the value shown (cobrasphere-verify= followed by a token). Once the record is found, the claim is verified and the scan results for that domain show on the same page.
- One business holds each domain. The record is checked again each month, and a claim ends 14 days after the record stops being found.
- Results for a domain go only to the business that holds its claim.
- Data is held in the UK and Germany, and kept for as long as access is active, plus 12 months, then deleted.
- Why: ZoneAudit shows where an organisation is exposed, so CobraSphere confirms the requester represents the domains before anything is shown.

## Level 0 self-check

- Open to anyone: https://zoneaudit.com/en-gb/level0
- After the work email is confirmed with a one-time code, the check runs and results show on screen. A verified email on a different domain sees only a general result; the details go to verified owners only.

## Community Edition CLI

- ZoneAudit Community Edition is an open-source command-line program, MIT licence: https://github.com/ZoneAudit/zoneaudit-cli
- It runs DNS, TLS, RDAP and HTTP checks against a single domain on the user's own computer and prints raw findings as text or JSON.
- Install on macOS or Linux: curl -fsSL https://zoneaudit.com/install.sh | sh
- Install on Windows (PowerShell): irm https://zoneaudit.com/install.ps1 | iex
- Responsible use: only scan domains you own or are authorised to test.

## Pages

- Home: https://zoneaudit.com/en-gb
- About ZoneAudit: https://zoneaudit.com/en-gb/about
- Questions and answers: https://zoneaudit.com/en-gb#faq
- Sample evidence pack (fictional company, example domains): https://zoneaudit.com/en-gb/sample-evidence-pack
- Request access: https://zoneaudit.com/en-gb/access?tab=request
- Enter your access code: https://zoneaudit.com/en-gb/access?tab=code
- Claim your domain: https://zoneaudit.com/en-gb/access?tab=claim
- Level 0 self-check: https://zoneaudit.com/en-gb/level0
- Privacy: https://zoneaudit.com/en-gb/legal/privacy