Prove you control a domain with one DNS TXT record. Then see which public breaches touched addresses on it, and keep watching. You walk in; nobody is looked up, nobody is contacted, and no leaked password is ever held.
Create the record above at your DNS host (any TTL). Propagation usually takes a few minutes.
Verified owners can run mesh-breach-check. It returns breach names, dates, how many of your addresses each touched, and the addresses (yours — you proved it). Never a password or hash.
A daily re-check for new breaches; results arrive as estate.breach events on your webhook subscription.
Every certificate logged to Certificate Transparency for names under your domain in the last 90 days: hostnames, issuer, validity, and anything expiring soon. A certificate you don't recognise is the earliest sign of mis-issuance or shadow IT. Public data, no upstream key, live today.
SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA and DNSSEC read from public DNS and scored, with the exact record to publish for anything that falls short. No request ever touches your servers. Live today.
What changed on a host's public face since you last looked: the read-only external observation (ten fixed HTTPS reads), snapshotted, diffed against your previous one. Needs the host verified under your domain and a 24-hour authorization-to-test you attest to each time — so there is no unattended watch here, by design.
Hard rules, enforced in code: only DNS-verified domains, re-checked on every call · no person lookup · no credential values · private/internal names refused · results are point-in-time.