Free tools
Small security checks, free forever
One-off versions of checks Bastion runs continuously. No signup, no email gate, and nothing you type reaches our servers — the DNS tools query public DNS-over-HTTPS resolvers straight from your browser, and the CSP builder never touches the network.
Dangling CNAME checker
Find CNAME records pointing at targets that no longer exist — the DNS leftovers that become subdomain takeovers. Sweeps common subdomains too.
Open the tool →
SPF & DMARC checker
Can strangers send mail as your domain? Reads your records, counts SPF DNS lookups against the limit of 10, and grades the policy receivers enforce.
Open the tool →
CSP builder
Describe your site and get a copy-paste Content-Security-Policy header — with plain-spoken warnings whenever a choice quietly defeats the policy.
Open the tool →
Why free? Because each of these is one snapshot of a thing that drifts. If the snapshot is useful, the monitoring is the product.
Checked once. Now have it watched.
Every check on this page is a point-in-time answer to a question that changes: records drift, vendors restructure their DNS, deploys drop headers. Bastion asks the same questions of your verified domains every night and tells you when the answer changes.
7-day trial of the full product, no card required. Scanning needs domain ownership verified by DNS — Bastion never scans anything you haven't proved you control.