Domain Forge · Live diagnostic

See what your domain is telling the internet.

ForgeScan reads the public signals behind your website and email, then separates real risks from optional improvements. No account or email required.

Scan a domain Prefer a human? Meet ForgeFix
Public signal set Live lookup
  • DNS address & nameservers
  • MAIL MX, SPF & DMARC
  • DKIM selector-aware signing key
  • DNSSEC signed DNS delegation
  • HTTPS secure web connection
  • RENEW registry expiry window

A score with context

Risk tells you what matters. Coverage tells you which checks completed.

A missing email policy is not the same as an expired domain. ForgeScan weights each finding by likely business impact and puts failures ahead of nice-to-have improvements.

Some checks need information that public DNS cannot reveal. Those appear as “not verified” and lower coverage instead of being counted as a failure. Add a DKIM selector when you know it.

One input, live evidence

Start with the domain

Use the name after www. or after the @ in your business email. ForgeScan reads public records only.

  • Results before any email request
  • No account and no password
  • Clear evidence behind every finding
Check your email signing key optional

Not sure? Leave it empty. DKIM will show as not verified and will not reduce your score.

What is a DKIM selector, and where do I find it?

A selector is the short label your email service uses for its public signing key. Some dashboards call it the DKIM host, record name, or prefix. It is not a password or an email connector.

google._domainkey.example.com Enter only google

How to find yours

  1. Open the “authenticate domain” or DKIM page in your email service.
  2. Or check your DNS records for a TXT or CNAME name containing ._domainkey.
  3. Copy only the part immediately before ._domainkey.

Common examples

  • Google Workspace: often google
  • Microsoft 365: selector1 or selector2
  • Other providers: sometimes default, mail, s1, s2, or k1

Use an example only if it appears in your provider or DNS settings. A guessed selector can look missing even when DKIM works under a different name.

Provider instructions: Google Workspace Microsoft 365

Free · usually under 10 seconds · full scan context expires after 24 hours

Home