The target is never contacted
ZeroKai does not scan ports or load pages. It does not contact the target. DNS queries go through public resolvers.
Attack surface management for small businesses
See your exposed assets the way attackers do
Attack surface management for small business owners and IT managers. ZeroKai maps your internet-facing assets, such as domains, email, certificates and public services, from public records, and shows each security weakness with evidence, in the order to fix it. One domain is free, and nothing scans your servers.
Observed 2026-10-12 09:41 JST
example.co.jp
CoveredDNS over HTTPS
Email authentication
v=DMARC1; p=none
Not covered
Public services
Included only after the domain is verified
For small business owners and IT managers
External attack surface
What an attacker can already find from outside the company: names, certificates, mail settings, and services on the internet.
Exposure management
Exposed assets in one list: domains, hostnames, addresses, and services. Full detail appears after you verify that the domain is yours.
Risk intelligence
Security weaknesses ordered by what to handle first. Each finding includes the evidence and the time it was seen.
- DNSDNS & mail auth
- CTCertificate logs
- REGRegistration
- NETNetwork
How an assessment works
- 01
Enter a domain
Enter the domain you want assessed and create an account.
- 02
Read what is already public
ZeroKai reads DNS, mail authentication, certificates, registration data, and services already visible on the internet. It does not contact your servers.
- 03
Prioritize what to handle
Each finding shows the evidence, the source, and when it was seen, so you can see what to handle first. Anything that could not be read is marked “not covered.”
What is checked
Attack surface, exposure, and the other words on this page, including SPF and certificates, are explained in the glossary.
GlossaryWhat is checkedSourceScope
Email authentication (SPF and DMARC) and DNS settings
DNS over HTTPS
Any domain
Host names and certificates recorded in Certificate Transparency logs
Certificate Transparency
Any domain
Domain registration data and expiry
RDAP/WHOIS
Any domain
Network and hosting information for IP addresses
RIPEstat
Any domain
Public services (Shodan observations, for domains you have verified only)
Shodan
Verified domains only
Principles
Details for the owner only
Asset lists and finding details appear only when your email domain matches, or when a DNS TXT record confirms ownership. Everyone else sees a summary.
“Not covered” is not “safe”
A source that failed, or a check this product does not do yet, is shown as “not covered”. That does not mean there is no problem.
CoveredNot covered
How ZeroKai differs from a vulnerability scan or a pentest
A vulnerability scan or a penetration test is a security assessment that sends traffic to your servers, with the owner's permission, to test the systems directly. ZeroKai's free assessment reads only public information, such as DNS, email authentication, certificates, domain registration and services already visible on the internet, to map the exposed assets and weaknesses an attacker can already see from outside.
Because it sends nothing to your systems, you can start right away without an authorization process. It does not replace a vulnerability assessment and does not certify that a system is secure. It is the first step that tells you which assets to test and what to fix first.
Questions
What is ZeroKai?
Attack surface management (ASM) for small business owners and IT managers. ZeroKai discovers exposed assets from public information, identifies security weaknesses, and shows which risks to handle first. A passive assessment of one domain is free. Continuous monitoring then helps prevent problems.
Does an assessment contact the target server?
No. ZeroKai does not scan ports or load pages. DNS queries go through public resolvers.
What does an assessment check?
Email authentication (SPF and DMARC) and DNS, host names and certificates in Certificate Transparency logs, domain registration and expiry, and network information for IP addresses. Public services from Shodan are included only for domains you have verified.
Who can see the detailed results?
Asset lists and finding details appear only when your email domain matches, or when a DNS TXT record confirms ownership. Everyone else sees a summary.
Does “not covered” mean the item is safe?
No. A source that failed, or a check this product does not do yet, is shown as “not covered”. That does not mean there is no problem.
Attack surface management for small businesses