Everything, for every client, in one place
Marchpost does four things well rather than twenty things badly: it watches, it scores, it alerts, and it reports.
Portfolio dashboard
Every client and every domain, ranked worst-first. One number per client, drill down to the finding in two clicks. The view answers "where do I spend the next hour" without you having to think about it.
40+ external checks
Email authentication, certificates, DNS, website hardening and exposed surface. Every check states what is true, why it matters to a business owner, and the exact change to make.
Change alerts, not state alerts
You are told when something became true. A risk the client has knowingly accepted does not email you every week, so the alert that does arrive is worth reading.
White-label client reports
Your logo, your colours, your name, no "powered by". Shareable link, prints cleanly to PDF, written for someone who does not know what a CNAME is.
Scheduled monthly reporting
On the 1st, a report for every active client is generated automatically and you get one digest email. Nothing goes to your clients without you sending it.
Deterministic scoring
A published ruleset, not a model. The same configuration always scores the same, which is the only way "your score went up" means anything to a client.
Client grouping and roll-up
A client with four domains gets one score across all of them, weighted by severity — so the forgotten legacy domain cannot hide behind the well-maintained main site.
Bulk import
Paste a list of domains, one per line. Sixty domains are scanned and populated in a few minutes with no per-domain setup.
The complete check list
Weights in brackets are each category's contribution to the overall score. How scoring works.
Email authentication
30% of score- MX records
- Whether the domain receives mail, and which platform handles it.
- SPF present
- A record listing who may send as this domain.
- SPF duplicates
- Two SPF records is a permanent error that disables SPF entirely.
- SPF lookup budget
- We follow every include and redirect and count the DNS lookups. Over ten and SPF silently stops working.
- SPF all mechanism
- +all authorises the whole internet — worse than publishing nothing.
- DMARC present
- Whether a policy exists at all.
- DMARC enforcement
- Whether the policy actually acts, and on what percentage of mail.
- DMARC reporting
- Whether anyone is receiving aggregate reports.
- DMARC subdomain policy
- Whether subdomains are exempted from the policy.
- DKIM keys
- Probed across 20 selectors used by the major mail platforms.
- MTA-STS
- Protection against downgrade attacks that strip TLS from inbound mail.
- TLS-RPT
- Reporting on failed inbound mail encryption.
Certificates & encryption
25% of score- HTTPS availability
- Whether an encrypted connection is possible at all.
- Certificate expiry
- Escalating severity at 30, 14 and 7 days.
- Chain trust
- Self-signed or missing intermediate certificates.
- Hostname coverage
- Whether the certificate actually covers the name visitors type.
- Obsolete protocols
- TLS 1.0 and 1.1 still being accepted.
- HTTP to HTTPS redirect
- Whether plain HTTP is upgraded.
DNS & domain
15% of score- DNSSEC
- Whether DNS answers are cryptographically signed.
- Nameserver redundancy
- A single nameserver is a single point of failure for site and mail.
- CAA records
- Which certificate authorities may issue for this domain.
- Subdomain takeover
- Records pointing at decommissioned third-party services that anyone can re-claim.
Website hardening
20% of score- HSTS
- Present, and with a max-age long enough to matter.
- Content Security Policy
- The main defence against cross-site scripting.
- Clickjacking protection
- X-Frame-Options or CSP frame-ancestors.
- MIME sniffing protection
- X-Content-Type-Options: nosniff.
- Referrer Policy
- Stops full URLs leaking to third-party resources.
- Cookie flags
- Secure, HttpOnly and SameSite on cookies set by the homepage.
- security.txt
- A documented route for researchers to report problems.
Exposed surface
10% of score- Server version disclosure
- Banners that tell an attacker which exploits to try first.
- CMS identification
- WordPress, Drupal, Joomla and others, with version where published.
- Exposed .env files
- Verified domains only. Application secrets served as plain text.
- Exposed .git directories
- Verified domains only. The full source history, downloadable.
- Database dumps and backups
- Verified domains only.
- Debug logs and phpinfo
- Verified domains only.
- Directory listings
- Verified domains only.
Checks marked verified domains only run after you prove control of the domain with a DNS TXT record. We will not probe a stranger's server for configuration files on somebody else's say-so — here is our full scanner policy.