Check your domain the way a customer meets it
Seven things decide whether a Malaysian business looks real online: the padlock that expires without warning, the email settings that let anyone spoof your address, the records that stop mail being downgraded on the way, the link preview your customer sees when you send them a WhatsApp, whether the address works both with and without www, who actually holds the domain, the mail and the hosting, and whether the page is served with compression, cookie flags and a version banner. This service reads all seven from the public internet, in a few seconds.
Enter the domain you send email from and put on your name card. Nothing is installed, nothing is uploaded, and no account is needed.
What a customer’s phone settles before it trusts your link
Registry
The domain is registered, paid for and not on hold.
Redirects
With and without www both land on the same live page.
HTTPS & SSL
The certificate is valid at the address a visitor actually reaches.
Mail & preview
Mail records hold, and the chat card shows your real image and title.
All four are public records and public responses. That is why this needs no login, installs nothing, and can be re-run by anyone you send the report to.
Certificate & HTTPS
When the padlock expires, Chrome shows a full-page warning and every customer turns back. We read the live certificate off the same connection a browser would make.
Email: SPF, DKIM, DMARC
Without these, anyone can send mail that claims to be from your address — and your own invoices start landing in spam.
Redirects, headers & link preview
We follow the redirect chain a visitor follows, then draw the card WhatsApp will show when someone pastes your link into a chat.
With and without www
Both forms of your address are requested. If they end on different pages, a link you share on WhatsApp opens the wrong one for half the people who tap it.
Mail transport: MTA-STS, TLS reports, BIMI
SPF and DMARC say who may send as you. These three say the mail cannot be downgraded in transit, that you hear about failures, and that your logo can appear in the inbox.
Compression, CAA, cookies, version banners
Four small facts about how the page is served: whether it arrives compressed, which authorities may issue a certificate, whether cookies are locked down, and whether the server is advertising its own version.
Who holds the keys
Registrar and expiry date from the registry, who runs your mail, where the site sits and how many nameservers hold it up — the facts a business owner is usually paying somebody else to remember.
What this is not
It is not a security audit, not a penetration test, and not a guarantee about where your email lands. It answers seven narrow questions with evidence you can see, and it says skipped — not broken — when a site's firewall refuses to talk to a machine. Exactly what it queries is written down here.
More browser-based utilities that never upload your data — CSV, WhatsApp links, email headers: tools.hoelee.com.