Free tool · Public DNS only · Nothing stored
Who controls your domain?
Type your domain. In a few seconds you'll see who runs its DNS, where your email goes, whether you publish a DMARC policy, and whether an old on-premises mail server is still visible. Everything shown is already public.
Check a domain
That's what public DNS can show. The questions that decide whether you actually control your IT are below, and none of them are visible from outside. See the 8 things DNS can't tell you.
The part that matters more
8 things DNS can't tell you.
Whether you could remove your IT provider's access without their cooperation, and keep control, comes down to these. None of this implies bad faith. It's how environments end up when one firm sets everything up.
-
01
Who holds Global Administrator in Microsoft 365
If no one on your own staff holds it, you can't see or change your tenant, including removing anyone's access, without help.
-
02
Whose account the domain is registered in
DNS shows where the domain is served from, not who can log in to the registrar and renew or move it.
-
03
Who bills your Microsoft licences, and when they renew
Licences bought through a partner are billed by that partner, often on annual terms. Microsoft won't move them to another partner without the current partner's approval.
-
04
Where the BitLocker recovery keys are
A laptop that asks for its recovery key when none is on file can't be unlocked.
-
05
Whose name the backup account is in
If the backup tenant belongs to your provider, your backup history may not come with you.
-
06
Whether you could remove the remote-management agent
Many agents need a removal password to uninstall. Without it, someone else keeps a remote shell on your devices.
-
07
Who holds the firewall admin login
Without it you can't review or change what's allowed into your network.
-
08
Your IT agreement's renewal date and notice window
Many agreements auto-renew. Miss the notice window and the decision is made for you for another term.
Our Separation-Readiness Review answers all eight in writing, read-only, and gives a plain answer: yes, yes with conditions, or not today. You keep the report and the scripts. It doesn't require changing provider. Most of the fixes can be done by the provider you have.
FAQ
Questions about this check.
Does Pro IT NW see or store the domain I check?
No. The lookup runs in your browser and asks a public DNS resolver (Cloudflare's, or Google's if Cloudflare doesn't answer) the same questions any mail server asks every day. Nothing is sent to Pro IT NW, nothing is saved, and the domain never appears in this page's address, so it can't reach our analytics either.
Is a missing DMARC record proof that we've been hacked?
No. A missing DMARC record means receiving mail servers get no instruction from you about what to do with mail that forges your domain. It's a hygiene gap that makes impersonation easier, not evidence that anything has happened.
Why does it say "a third party" runs our DNS instead of naming them?
The tool names the big registrars and DNS services by category and deliberately doesn't name anyone else. The name servers themselves are listed under "Records we read" so you can see exactly where your DNS is served from. Whether that's fine depends on one thing DNS can't show: whether your organization can sign in and make changes without help.
We still have an on-premises Exchange endpoint. Is that wrong?
Not necessarily. Many organizations run hybrid Exchange on purpose. It's worth confirming it's intentional, though: an endpoint left over from a finished migration is a server someone still has to patch, and it faces the internet.
Want the eight answers in writing?
An independent, read-only Separation-Readiness Review: who holds the keys today, and what to fix first, whether or not you ever change provider.