External domain check

What the check covers

It covers the domain only. One order covers one registrable domain, its www form, its email settings and its mta-sts subdomain. Other subdomains are not part of it.

The check does not tell you how secure your company is. From outside I cannot see passwords, backups, staff computers or how staff handle phishing. SPF, DKIM and DMARC only show whether someone can send mail in the domain's name. The report says this on its first page.

A missing header, a visible version number or a missing SameSite flag is an observation, not a confirmed vulnerability, and the report says so. A missing result is never counted as a pass.

Who it is for

The check is sold only to businesses and other organisations acting in their trade or profession, as my other services are. It is not sold to consumers.

I run it as a pilot aimed at owner-run Shopify stores that have their own domain and their email on it. Other companies can order too and get the same report.

In a Shopify store, some TLS, header and IPv6 settings and some root files, such as /llms.txt, can be under the platform's control. The report then puts the weight on email and DNS settings and on the agent-readiness gaps the store can fix itself. It says which settings belong to the platform and does not hand them to you as fixes.

What the report contains

• Limits. What cannot be seen from outside, what was not measured and which settings the platform or your email provider controls.
• Agent-readiness. The score and level, or "no reading" with the reason, the measurement date, the list of checks run and up to three of the largest gaps.
• Observations. A table of what I measured, what it means in one sentence and how much a fix matters for this site, marked high, medium or low, or "no reading". The mark compares the benefit of a fix with the work. It is not an estimate of how secure your company is.
• Fixes. Up to three, in the order to make them, chosen from the readings and the observations together. Security findings are written as tasks you can give to whoever maintains your site now. If there is little or nothing important to fix, the report says so and does not invent more.
• Next step. Either no further work is needed now, or one follow-up with the reason. For a Shopify store the follow-up is the Shopify agent storefront check, and for another company or a wider need it is the audit. If I propose one, the report says in one sentence what it does beyond this report and which finding it answers.
• Links. The public tests you can run again yourself, isitagentready.com and internet.nl. My own readings are marked, and there is no public test for them.

The report is in Finnish for a company with a Finnish Business ID, unless you ask for English, and in English for every other company. A Finnish report addresses you formally.

Price and delivery

The check costs €99 plus VAT. VAT is added as on my other services, at 25,5% for a Finnish customer. A business customer in another EU member state with a valid VAT ID and a customer outside the EU pay €99 with no Finnish VAT.

I deliver within two business days of confirmed payment. A business day is Monday to Friday in Finnish time, excluding Finnish public holidays. In those two days I send either the report or notice that a main part is rerun. The rerun is then done within two business days of the notice.

Measurement starts when Stripe confirms the payment. That is the agreed start of this service. A re-measurement after you make the fixes is not included.

If you find a deviation from this page in the report, tell me in writing within 14 calendar days of delivery. I correct it at no charge within 10 business days of your message.

The 60-day deduction

The €99 is deducted from a Shopify agent storefront check or an audit for the same domain ordered within 60 days of delivery, once per company. The conditions are these.

• The order comes from the same company, with the same Business ID or equivalent register ID, and covers the same registrable domain.
• The 60 days run from the day I deliver the report to the day you send the follow-up order in writing.
• The deduction comes off the price of the follow-up order before VAT, and VAT is calculated on the reduced amount.
• It shows as its own line on the follow-up invoice with a reference to the first order. The invoice for the €99 is not changed.
• A company gets it once. It is never paid out as money.
• A Shopify agent storefront check qualifies only for a Shopify store, because that check covers only Shopify stores.
• It is not given if the price of the €99 check was refunded. If the refund comes after the deduction was used, the deduction is charged back on the follow-up invoice.
• If you cancel the follow-up order before delivery, the deduction becomes available again until the original 60 days end.
• If I stop offering the check, the 60 days for checks already delivered stay valid.

Across both orders you pay what the larger work costs on its own, €999 for the Shopify check or €4,300 for the audit, and you also have the report from the €99 check.

How to order

The order is an email. There is no form, and everything happens in writing. The button above opens a draft with the fields below, or you can write the same details in a plain email to info@turva.dev.

• Send the order by email with the fields listed below.
• I acknowledge it in writing within one business day. The acknowledgement repeats your details so you can correct them by replying before any payment link exists. It links the terms on the legal page and its Markdown copy, names their date and contains a one-time code.
• You verify that you may order for the company. Reply from an address at the domain with the code and this statement: I confirm that I am authorised to order this check for <company>. Or add a DNS TXT record at _turva-verification.<domain> with the value the acknowledgement gives, and reply from your contact address with the same statement. Either way the reply confirms the address I deliver to.
• I check a Finnish Business ID in YTJ, the Finnish Trade Register. I check a foreign register ID in that country's open register and the VAT ID in the EU's VIES service. If an ID cannot be found or a check fails, I ask you for more information, and the order lapses without charge if you do not answer within seven days. The order also lapses without charge if the verification has not succeeded within seven days of the order.
• I send a payment link for this order alone. It covers one payment and is valid for 14 days. If no payment arrives in that time, the link is closed and the order lapses without charge.
• If a payment confirms late, the order does not lapse until the payment has confirmed or failed, at most 14 days after the payment session completed. After that the order lapses without charge, and a payment confirmed later is refunded. If a payment fails, I send one new link, valid for seven days.
• Measurement starts when Stripe confirms the payment. A payment success page alone does not start it, because some payment methods confirm late.

I keep your order email and my acknowledgement, and I give you a copy on request for as long as I keep them. The legal page sets how long that is. No code of conduct applies to this service. The contract language is English.

The order template has these fields:

• Company name.
• Business ID or equivalent register ID.
• VAT ID, if you have one.
• Billing address.
• Domain.
• Whether the store is on Shopify.
• Contact person.
• Contact email address at the domain.
• Where you heard about the check, optional.

Its last line is the acceptance of the terms, I accept the terms dated 2026-10-29 at https://turva.dev/legal.

What I request from your domain

My own requests are a fixed list. I send at most seven GET requests per order, one after another and at least two seconds apart. Every attempt and every followed redirect counts toward the seven. The requests carry this User-Agent string:

Mozilla/5.0 (compatible; turva.dev-domain-check/1.0; +https://turva.dev/external-domain-check; info@turva.dev)

The requests are these:

• The home page, https://<domain>/.
• The www form, https://www.<domain>/, only if it is a different address and the home page did not already redirect there. I record its status as an observation.
• The file /robots.txt on the measured host.
• The file /sitemap.xml on the measured host.
• The file /llms.txt on the measured host.
• The MTA-STS policy, https://mta-sts.<domain>/.well-known/mta-sts.txt, only if the DNS name _mta-sts.<domain> has a TXT record. I never follow a redirect there, as RFC 8461 requires, and the result is then "no reading: redirect".
• One spare request. It is either the target of the home page's first redirect, if that target is the domain or its www form and I have not requested it yet, or one retry after a timeout, a connection error or a 5xx answer. It is never both.

The measured host is the domain, or its www form if the home page redirected there. I follow a redirect from the home page at most once. If the home page redirects anywhere else, I do not follow it, and the report only says where it went. A redirect from /robots.txt, /sitemap.xml or /llms.txt is recorded from its Location header and not followed. I make no request to any host other than the domain, its www form and the mta-sts subdomain, and I do not guess other paths. If the domain points to a private or local network address, I make no request to it, and the report says why.

I also make DNS queries from a fixed list. They ask for the CAA records of <domain>, the TXT records of _mta-sts.<domain> and _smtp._tls.<domain>, the TXT record of _turva-verification.<domain> on the DNS route only, and the A and AAAA records of every host I send a request to. They go to Cloudflare's 1.1.1.1 public resolver over DNS over HTTPS. The resolver receives the names I query, and Cloudflare's privacy page for it describes what it keeps.

From the home page response I read the server and software versions in headers such as Server and X-Powered-By and in the generator meta tag, the hosts of third-party scripts, and the Secure, HttpOnly and SameSite flags of cookies. I do not store cookie values. I record each cookie's name with its flags. The value of each Set-Cookie header is removed before anything is saved. I see only cookies that the home page sets in its response, and in the response after the one redirect I follow, not cookies that JavaScript sets, and the report says so. For the report I keep selected response headers without cookie values, and the first 20,000 bytes of robots.txt, sitemap.xml, llms.txt and the MTA-STS policy. I do not keep the home page's HTML.

The two public tools

The two tools make their own requests from their own servers. Their scope is their own and is not part of my list of seven.

• isitagentready.com. I run its scanner twice with the default profile and record the date and the checks it ran, because its scope changes over time. Its public description does not say how it handles redirects. Its footer links Cloudflare's privacy policy.
• internet.nl. I run its website and email tests, which cover IPv6, DNSSEC, HTTPS and TLS, security headers, security.txt, RPKI, SPF, DKIM, DMARC, STARTTLS and DANE. I read security.txt only from this test and never request it myself. Its privacy statement says it stores the tested domain names, shows them in the test report at a permanent link and can show them in its Hall of Fame. I cannot remove a stored result. The statement also names WHOIS lookups, Team Cymru and Sentry as services that can receive details of a test.
• Mail servers. The email test of internet.nl checks secure connections to mail servers, and those can be your email provider's servers, for example Microsoft 365 or Google Workspace. The result describes your domain's mail setup, which includes your choice of provider. It is not a rating of the provider, and the report says which settings only the provider can change.

By accepting the terms you accept that both tools receive your domain and that internet.nl stores and publishes its result as described. The terms on the legal page name both tools.

What the check does not do

• I run no port scans.
• No logins and no forms submitted.
• No credentials and no reading of your application's source code. I read the public HTML of the home page only for the readings listed above.
• I try no other paths than the ones listed above.
• It is not a penetration test, an audit of your security, a certification or a statement of compliance.
• It is not a NIS2 assessment. It does not decide whether the Finnish cybersecurity act applies to your company, and it does not claim to meet any legal duty.
• It gives no security rating of your company.

If a reading is missing

The main parts are the agent-readiness reading and the internet.nl website and email results.

A finished measurement that ends in "no reading" with a reason is a valid result, and it is not grounds for a refund. Examples are a report that your site blocked the scanner, and two finished runs of the scanner that disagree where the difference cannot be settled. A report with nothing to fix is also a valid delivery.

I refund the price only when a measurement could not be run at all. A run is done when the tool returns a report, even a report in which checks fail or categories are missing. It is not done when the tool returns no report, for any reason, or when I could not start it. In that case I tell you and rerun the part that stopped within two business days of the notice. A scanner run that stopped is rerun so that there are two finished runs. It is not a third run to settle a difference between finished runs.

If the rerun also fails within that time, I send a partial report and a notice of the missing part by the last day of that period, and I refund the whole price, VAT included.

The delay and continuity terms on the legal page apply to this service as well. If the report is late because of turva.dev, or I cannot work, you can cancel, and the price you paid is refunded. Every refund is paid within 14 days of the cancellation or of the deadline that triggers it, under those terms.

See a sample

The sample report is made from turva.dev's own domain with real readings, each with its own measurement date. It shows the six parts of a report.