All the trust checks for your domains, in one dashboard

Detect DNSSEC gaps, risky or stale records, weak configurations and missing protections, so your namespace can't be quietly tampered with.

• DNSSEC signing and chain-of-trust validation
• Nameserver health, redundancy and consistency
• CAA, dangling and risky record detection
• Zone hygiene and exposure scoring
• DANE (TLSA) checked on your inbound mail servers and on every certificate endpoint

We do not host your zone. We read what the world’s resolvers see.

Every plan Try it free on your domain

Evaluate your HTTPS configuration, protocol strength, cipher exposure and certificate-chain trust against current best practice.

• Protocol versions and deprecated-protocol exposure
• Cipher-suite strength and forward secrecy
• Certificate-chain completeness and trust
• Web security headers on the home page: HSTS, CSP, framing, cookie flags, mixed content and SRI
• Full TLS detail per endpoint on Pro and up: every accepted version and cipher suite, key exchange groups and which common clients can still connect
• TLS 1.0, TLS 1.1, 3DES and RC4 tried on every scan; each endpoint that accepts them costs a point in your score

We do not sit in front of your site. Nothing is proxied, we only look.

Every plan, full handshake detail on Pro and up Try it free on your domain

Monitor lookalike domains, typosquatting, homoglyphs and phishing infrastructure that impersonate your brand and target your customers.

• Lookalike and typosquat domain discovery
• Homoglyph and confusable-name detection
• Suspicious-registration and phishing signals
• Impersonation and domain-abuse indicators

We do not take lookalike domains down. We find them early and give you the evidence to report them.

Growth and up, or the Brand Protection add-on

Generate exportable reports and evidence for audits, security reviews, vendor assessments and board reporting, including NIS2-aligned evidence. Publish a Trust Page: a public, opt-in page with your trust score and the controls behind it, signed so anyone you send it to can check it was not edited.

• NIS2-aligned evidence reports (PDF)
• Point-in-time posture snapshots and history
• Vendor-assessment and security-review exports
• Signed executive reports for the board
• Public Trust Page: signed, shareable with your insurer, auditor or buyers
• eIDAS qualified certificates (QWAC, QSealC) checked against the EU trusted lists of all 32 territories
• Organisation names in OV and EV certificates compared with the company registers
• Board and insurer reports in plain language, signed like the rest

Evidence, not certification. Your auditor still decides; we give them something they can check.

Enterprise, or the NIS2 Evidence Pack add-on Try it free on your domain

# Domain trust evidence
period      = 2026-06
coverage   = 96%
posture    = 71/100
sha256     = a3f1…9e2c

An add-on for financial entities and their ICT third-party providers: we assemble the technical evidence behind DORA: a shareable supplier-readiness trust page, Register of Information support and audit-ready exports. Certification stays with your auditor; the add-on supplies the evidence underneath it.

• Supplier-readiness trust page you can share with clients
• Register of Information (RoI) data support
• Audit-ready, exportable DORA evidence
• Continuous ICT-risk signals across your domain estate

Certification stays with your auditor. The add-on supplies the technical evidence behind the questionnaire.

Add-on

# DORA supplier-readiness evidence
entity     = ICT third-party provider
roi        = linked
posture    = 71/100
sha256     = a3f1…9e2c

Your CA records what it issued. An external scan shows what is live. We keep both sides in one ledger and flag every certificate where they disagree, including revoked certificates that are still serving traffic. Available on Growth and Enterprise.

• Connectors for EJBCA, HashiCorp Vault, AD CS and step-ca, plus PEM import for any other CA
• Detection of revoked certificates still serving traffic
• Surfacing of issued certificates that never reached production
• Deployed certificates with no issuance record on file
• Public CT corroboration of deployed certificates, before any CA is connected

We read what your CA recorded; we never change it. Without a connected CA, a certificate is reported as not reconciled, not as clean.

Growth and up

If no CA is connected, certificates are reported as not reconciled rather than as clean.

Issue and revoke certificates on the certificate authority you already run, from the same screen that monitors them. One add-on, four kinds of CA.

• EJBCA and AWS Private CA over their APIs; AD CS, HashiCorp Vault and an internal EJBCA through the agent
• Issue from a signing request, revoke with a reason, every action recorded
• CA health: CRL freshness and OCSP answers checked, with an alert when a CRL goes stale

We do not run a CA for you and we never hold a private key. Your CA signs; we ask it to, with your approval.

Enterprise, or the Private CA Management add-on Read more

A public page, switched on by you, that shows your score and the checks behind it, signed so an insurer, a buyer or an auditor can verify it without trusting us or you.

• Your score, the controls behind it and the date of the last scan
• Signed evidence file and a verify link on every page
• Off by default; you decide who gets the address

It is not a self-declared trust center. The numbers come from scans, and the signature proves nobody edited them.

Pro and up Read more

For manufacturers of products with digital elements: a product register with the classification recorded, a gap assessment per product against Annex I and Article 13 with evidence attached, SBOM matching against public vulnerability sources, the vulnerability-handling log, secure-update evidence and the document drafts, with a signed product evidence report on your evidence chain.

• Product register: role, class, conformity route, support period and intake channel per product, classified by the same cited rules as the free check
• Gap assessment per product against Annex I Part I and Part II and the Article 13 duties: status, owner, due date, evidence files and the written justification where an item does not apply
• Signed CRA Product Evidence report per product and period, verifiable on the public verify page; the NIS2 report gains a per-product section
• SBOM upload (CycloneDX or SPDX) per version, components matched daily against OSV.dev and the NVD with CISA KEV and EPSS, alerts for vulnerable and known-exploited components
• Vulnerability handling: disclosure policy record, security.txt check, intake and remediation log with a timestamp per stage, advisories drafted and exported
• Secure updates: the mechanism, whether security updates are separate and free, the availability period, the code-signing identity and the TLS posture of the update endpoint
• Document builder: Annex VII technical documentation, Annex II user information and the Annex V declaration draft, generated from the register, editable, exported as Word, versions kept

Rows are manufacturer-declared and recorded by SkyQon, never verified by us. A known-exploited match offers to start the Article 14 clock; a person decides. The manufacturer signs the declaration; we do not declare conformity. Not legal advice.

Pro and up · add-on Try the free scope and class check Read more

NIS2 and DORA make your suppliers part of your security. Watch their domains from outside the same way you watch your own, and keep a record of what you asked them and when.

• A grade for every supplier, with its history and an alert when it drops
• The NIS2 Article 21(2) supplier questionnaire, sent as a link and answered without an account
• A supplier can dispute a finding and ask for a re-scan
• Results in your NIS2 and DORA evidence

We only look at what any outsider can see. We do not log in to a supplier’s systems.

Add-on, included with the DORA Trust Center Free supplier check

Run SkyQon for your clients from one console: each client in its own space, your branding on the reports, and a report you can bring to a prospect.

• One partner console across all your client accounts
• Reports with your own logo and colours
• A prospect report from the outside check, ready for a first meeting
• Tickets into HaloPSA for the findings you take on

Each client stays separate. One client never sees another.

MSP add-on, partner pricing Read more