External monitoring
External monitoring is your outside‑in view: what an attacker can see and probe from the internet, checked automatically so you don’t have to remember to look.
Find it under Technology & Threats → External Monitoring (/external-monitoring). The checks run against your organisation’s domains, so if you haven’t added a domain yet the page asks you to add one first. See Assets — Domains.
What’s on the page
Section titled “What’s on the page”| Card | What it checks | Sources |
|---|---|---|
| Email authentication | Whether your primary domain can be spoofed in email: SPF, DMARC, DKIM, DNSSEC and MTA‑STS. See below | Your public DNS records |
| Domain & External Exposure | Certificate and TLS configuration, security headers, and whether your domain is flagged as malicious | SSL Labs, Mozilla Observatory, VirusTotal |
| Domain Intelligence | Domain registration details, open ports and known CVEs on your public IPs, reputation and blocklist listings, and how many of your people appear in known breaches | RDAP/WHOIS, Censys or Shodan InternetDB, AlienVault OTX, abuse.ch URLhaus, Spamhaus, XposedOrNot and Have I Been Pwned |
| Dark Web & IP Monitoring | Whether your public IP addresses have been reported for abuse. Run check refreshes it | AbuseIPDB |
| Vulnerability Assessment | The individual findings from the certificate and security‑header scans | SSL Labs, Mozilla Observatory |
Look‑alike domain detection (DNSTwist) and subdomain discovery (crt.sh) also run against your domains; their findings appear in the External lane of your Posture dashboard.
Email authentication (SPF, DKIM, DMARC)
Section titled “Email authentication (SPF, DKIM, DMARC)”Email authentication records stop other people sending email that looks like it came from you. 786 Cyber checks one domain per organisation: your primary domain from Settings → Organisation, in its registered form (so www.example.com is checked as example.com). www. and other subdomains share that domain’s DMARC policy, so they aren’t checked separately. If no primary domain is set, nothing is checked. For that domain it looks at:
| Record | What we look for |
|---|---|
| SPF | Missing; more than one record; a record that allows any sender (+all) or has no all at the end; a neutral ?all; more than 10 DNS lookups across its includes (receivers stop checking past 10) |
| DMARC | Missing; more than one record; monitoring only (p=none); applied to less than 100% of mail (pct below 100); no reporting address (rua) |
| DKIM | Whether a signing key can be found. We try your own selector, if you’ve given one, plus 19 common ones, and spot wildcard records that would give a false match |
| DNSSEC | Whether the domain is signed and validates |
| MTA‑STS | Informational only, and only for domains that receive email |
Domains set up not to receive email (a “null MX” record) aren’t flagged for DKIM or MTA‑STS.
If DKIM shows Not found but you do sign your email: your mail provider probably uses a selector we don’t try. Add it as the DKIM selector on a domain asset for that domain (in Assets), and the next check will use it. Domain assets don’t add extra domains to the check; they only supply the selector. Your provider’s admin console shows the selector, or look for s= in the DKIM-Signature header of an email you’ve sent.
Never a false all‑clear. If an SPF or DMARC lookup fails, that domain is shown as not checked, with no findings, rather than clean. If another lookup fails, the run is treated as incomplete, so it doesn’t close any findings it couldn’t recheck.
On the card, open issues to see each finding and how to fix it.
Findings appear on the card and in the External lane of your Posture dashboard. A clean, complete result also counts as evidence for the email security capability on Security capabilities.
When it runs
Section titled “When it runs”- When your organisation is first set up: an initial sweep as soon as your domain is in.
- Weekly: every Monday at 06:00 UK time.
These checks aren’t run on demand; the exception is Run check on Dark Web & IP Monitoring. The email authentication check covers your primary domain only.
Breach checks on people: for organisations of up to 10 people, the weekly sweep checks each person’s email against known breaches automatically. For larger organisations, per‑person checks aren’t run automatically yet. Breach results also appear on each person in the People directory.
Dark‑web monitoring: despite the card’s name, there’s no dark‑web source connected yet. The card currently reports IP abuse reputation only. We’ll update this page when a dark‑web source is added.
Reviewing results
Section titled “Reviewing results”- Each card shows its latest result and when it last ran. A source that couldn’t be reached is shown as unavailable or error, never as a false “all clear”.
- Findings flow into the External lane of your Posture dashboard, where you work them like any other finding, and into the Beware of this feed on your Overview.
Why it matters
Section titled “Why it matters”For everyday security: most incidents start with something exposed or impersonated on the internet. A missing DMARC record or an over‑permissive SPF record is one of the easiest ways for someone to send phishing email in your name. Weekly outside‑in checks mean you find out early.
For compliance: email authentication, external vulnerability scanning and monitoring of your internet‑facing footprint support Cyber Essentials, NIS2, NCA ECC, SAMA CSF and Qatar NIA requirements, among others, and the weekly cadence evidences continuous monitoring rather than a once‑a‑year snapshot.
Next: Testing & Validation →