Forged email in your name, refused. Closed where we reach your DNS host, one click per step.
Your domain publishes records that tell every mail server what to do with a message that claims to be from you. Many firms publish none, or one that blocks nothing. We read yours from outside and say in plain words whether a forged message is refused or delivered.
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.
Three settings decide whether a forged message gets through.
On 14 October, BleepingComputer reported Organizations across 150 countries: the way in was email made to look like it came from a trusted sender.
Receiving mail servers are given no instruction, so a message that fakes your address is judged on its own and often delivered.
A DMARC record set to p=none only watches: it blocks nothing. It is the first step, not the finished setting.
An SPF record ending in ~all asks receivers to accept and mark a message from an unlisted server, not to refuse it.
In the paid assessment, forged email is closed from your assessment page: it is done in stages you confirm, so that none of your real mail is lost, with a re-check between each stage. Where we cannot write to your DNS host, the assessment gives you the exact steps.
LeakTrace index, readings to 8 October 2026.
Measured across the firms we have assessed, not a national census. The method is in the study.
Attackers read businesses with AI. LeakTrace reads them first. Every finding carries its evidence.
A different job from the people you already work with.
Excellent at running your systems. We read what the outside world sees and give you the exact fix for each finding, with the check that proves it. Different job, and independent: we are paid by no one who sells the fixes.
Tries to break in and needs access. We are not a pen test: nothing attacked, nothing installed, no access given. We read only what is already public, from outside, and log into nothing.
It can feed your premium and eligibility, and we do not see it. We show you what anyone can see of your firm from outside first, in plain words, so you walk into renewal knowing your own answers.
On a paid assessment, the Close AI agent handles this one: it gives you the email-record fix and re-checks from outside when you mark it done.
Where it can make the change for you, it does so only when you approve each step.
Once you mark it done, AI chooses when to re-check, and only a fresh outside read closes the finding.
The assessment comes with an AI security agent on your dashboard: ask it about any finding in plain English and it answers from your own firm's findings.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
Find out whether a forged message in your name is refused or delivered.
The External Exposure Check: your outside reading, the openings a stranger can see on your firm today, with the proof for the lead finding. Read-only, from outside.