Question 1

What is a Domain Trust Score?

Accepted Answer

A Domain Trust Score is a 0-1000 numerical rating that measures a domain's security across 29 categories including DMARC, SPF, DKIM, SSL/TLS, DNSSEC, MTA-STS, BIMI, CAA, IP reputation, threat intelligence, and more. Higher scores indicate stronger security. Vysiro generates this score in seconds by scanning 162 security checks.

Question 2

How do I check my domain's DMARC record?

Accepted Answer

Use Vysiro's free DMARC checker at vysiro.com/tools/dmarc-checker. Enter your domain and get instant analysis of your DMARC policy, reporting configuration, and alignment settings. No signup required.

Question 3

What is the best DMARC monitoring tool in 2026?

Accepted Answer

Vysiro is a full domain security platform that monitors DMARC along with SPF, DKIM, SSL, DNSSEC, and more - 11 DNS protocols in one scan. Unlike single-protocol tools, Vysiro provides a unified TrustScore (0-1000), auto-fix recommendations, IP reputation checks, threat intelligence integration, and compliance mapping across 9 frameworks including SOC 2 and PCI DSS.

Question 4

How does Vysiro compare to other DMARC tools?

Accepted Answer

Vysiro scans 11 DNS protocols in one call versus competitors that focus on 1-3 protocols. It includes a REST API, an MCP server for AI agents, RFC-cited deductions on every finding, and audit-ready compliance proof packs. The free tier includes unlimited scans with 162 security checks.

Question 5

What is GEO and how does it affect domain security?

Accepted Answer

GEO (Generative Engine Optimization) ensures your domain security information is accurately represented by AI assistants like ChatGPT, Gemini, and Claude. Vysiro provides llms.txt, ai.txt, and OpenAPI specifications so AI systems can accurately represent your security status.

Question 6

Is Vysiro free to use?

Accepted Answer

Yes. The free tier includes unlimited one-off scans, 162 security checks across 11 DNS protocols, the full TrustScore breakdown, 3 copy-paste fixes per month, and a public API with 100 calls per month. Paid plans start at $29/month Starter for 5 domains with Push Fix (one-click DNS deploy via Cloudflare), daily monitoring, and compliance evidence packs.

Question 7

Does Vysiro offer annual pricing?

Accepted Answer

Yes. All paid plans offer a 20% discount when billed annually. Starter is $29/mo (~$23/mo billed yearly), Growth is $99/mo (~$79/mo yearly), and MSP Partner has custom pricing.

Question 8

What email protocols does Vysiro check?

Accepted Answer

Vysiro checks DMARC, SPF, DKIM, MTA-STS, TLS-RPT, BIMI, and DANE/TLSA - all in one scan.

Question 9

How does the AI Coach work?

Accepted Answer

The AI Coach analyzes your scan results and generates specific fixes for your DNS provider. It shows exactly which records to add or change.

Question 10

Can I scan multiple domains at once?

Accepted Answer

Yes. Add domains to your portfolio and scan them individually or in bulk. The TrustGate dashboard shows all domains at a glance.

Question 11

What compliance frameworks does Vysiro support?

Accepted Answer

PCI DSS 4.0, NIS2, CISA BOD 18-01, NIST SP 800-177, SOC 2, and GDPR. Each framework maps to specific protocol requirements.

Question 12

Is there an API?

Accepted Answer

Yes. Full REST API with Bearer token auth plus an MCP server for AI agent integrations. API keys are managed in Settings.

Question 13

How does Vysiro compare to PowerDMARC or EasyDMARC?

Accepted Answer

Vysiro scans 29 categories vs 1-3, includes AI-powered fixes, compliance mapping, and agent security - at a lower price point.

Question 14

Can MSPs use Vysiro for clients?

Accepted Answer

Yes. The portfolio dashboard lets MSPs manage multiple client domains, generate white-label reports, and embed trust badges on client sites.

Question 15

What is post-quantum cryptography (PQC) readiness?

Accepted Answer

PQC readiness checks whether your domain supports hybrid key exchange algorithms that will resist quantum computer attacks.

Question 16

How often should I scan my domains?

Accepted Answer

We recommend weekly scans. Paid plans include automated scheduled scans (daily on Starter, priority monitoring on Growth) with alerts for any score drops.

Question 17

What's the difference between Free, Starter, Growth, MSP Partner, and Enterprise?

Accepted Answer

Free includes unlimited one-off scans, 3 copy-paste fixes per month, and 100 API calls per month. Starter ($29/mo) adds 5 monitored domains with daily scans, Push Fix (one-click DNS deploy via Cloudflare), and compliance evidence pack export. Growth ($99/mo) adds 25 domains with priority monitoring, the full compliance pack with audit trail, AgentShield API, MCP tooling, and the What-If simulator. The two custom tiers differ by buyer: MSP Partner is for agencies and MSPs managing their clients' domains (multi-tenant, white-label + per-client reports, partner margin, dedicated partner manager), while Enterprise is for a large org securing its own domains at scale (volume internal domains, custom SLA + security review, security questionnaire support, procurement/MSA/DPA, dedicated CSM; SSO/SAML + SIEM export are on the roadmap).

Question 18

What is the MCP server for AI agents?

Accepted Answer

Vysiro exposes a Model Context Protocol (MCP) server that lets AI agents like Claude, ChatGPT, and Cursor query domain security data programmatically. Agents can scan domains, retrieve TrustScores, and get fix recommendations through a standard JSON-RPC interface.

Question 19

What is DMARC and why does it matter?

Accepted Answer

DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents email spoofing by telling mail servers how to handle unauthenticated messages. Without DMARC, attackers can send emails that appear to come from your domain, enabling phishing and business email compromise.

Question 20

How fast is a Vysiro scan?

Accepted Answer

A typical Vysiro scan completes in under 60 seconds. It queries multiple DNS resolvers in parallel using DNS-over-HTTPS, checks SSL/TLS certificates, security headers, and runs 162 checks across 11 protocols simultaneously.

Question 21

How does the embeddable trust badge work?

Accepted Answer

The trust badge is a lightweight widget you embed on your website to display your live TrustScore. It updates automatically after each scan and links to your public report page. Visitors see your domain grade at a glance, building confidence in your security posture.

Question 22

What is Agent Shield?

Accepted Answer

Agent Shield is a security layer that monitors and controls how AI agents interact with your domain data. It enforces guardrails on agent actions, logs every request for audit, and prevents unauthorized automated changes to your DNS records.

Question 23

Can AI coding agents use Vysiro?

Accepted Answer

Yes. AI coding tools like Claude Code, Cursor, and Windsurf can connect to Vysiro through the MCP server or REST API. They can scan domains, check security posture, and apply fixes directly from the development environment.

Question 24

How many protocols does Vysiro scan?

Accepted Answer

Vysiro scans 11 DNS protocols in a single request - DMARC, SPF, DKIM, DNSSEC, MTA-STS, TLS-RPT, BIMI, CAA, DANE, MX, NS - plus SSL/TLS, security headers, IP reputation, and the AI-agent surface. These feed into 29 scoring categories that produce your TrustScore.

Capability	Typical point tools	In Vysiro
DMARC report parsing + policy monitoring	EasyDMARC, Dmarcian	Reads your DMARC record, scores policy strength, parses aggregate XML reports inline. DMARC category (T-class), DMARC RUA tool
DNS records + blacklist lookup	MxToolbox	Full DNS resolution across 5 DoH resolvers, RBL cross-check on every MX host. DNS + IP Reputation categories
TLS / SSL grade	SSL Labs	Cipher + protocol grading on every scan, no separate report to run. SSL/TLS category
Security headers grade	SecurityHeaders.com	CSP, HSTS, X-Frame-Options, Referrer-Policy scored in the same call. Security Headers category
SPF record validation + flattening	autospf	Lookup count, mechanism order, recommended flattening surfaced as a Fix It issue. SPF category + SPF Flattener tool
DNSSEC verification	Verisign DNSSEC Debugger	DNSSEC chain validated end-to-end on each scan. DNSSEC category
BIMI record + VMC readiness	BIMI Group inspector	BIMI presence, logo URL, VMC link checked alongside DMARC enforcement. BIMI category
MTA-STS + TLS-RPT compliance	Hardenize, aykira	Policy file fetched, version parsed, TLS-RPT endpoint validated. MTA-STS + TLS-RPT categories
Certificate Transparency log search	crt.sh, Cert Spotter	CT log tail on every scan; subdomain inventory surfaces orphan certs. Certificate Lifecycle category + CT Log tool
Typosquatting / lookalike detection	dnstwist	Generates and resolves common permutations to flag live impersonators. Brand Integrity category
IP reputation / blacklist scoring	Spamhaus, Barracuda RBL	Multi-RBL lookup with graduated scoring (1, 2-3, 4+ list hits). IP Reputation category
Subdomain takeover scanning	nuclei takeover templates	8 dedicated takeover checks covering S3, Heroku, GitHub Pages, etc. Subdomain Takeover block (TAKEOVER_001-008)
Expiry Guard: cert, chain, DNSSEC + VMC expiry monitoring	TrackSSL, UptimeRobot SSL, StatusCake	One daily monitor watches every silent-expiry failure mode: leaf certificate, intermediate CA chain, DNSSEC RRSIG signatures, and the BIMI VMC behind your verified logo. Alerts at 30 / 14 / 7 days before each notAfter, with an auto-renew-aware downgrade so ACME certs do not spam. Certificate Lifecycle + DNSSEC + BIMI categories, via expiry-guard.ts + /api/cron/cert-expiry
Uptime / availability monitoring + downtime alerts	UptimeRobot, StatusCake, Better Stack	Periodic HTTPS check, status-change alerts via email / webhook. Edge availability and resolver health rolled into the same monitor. Edge Hosting + DNS Resilience + /api/cron/uptime
WHOIS + domain-expiry monitoring + alerts	WhoisJSON, whois.com, Uptime.com	Daily RDAP / WHOIS check with 30 / 14 / 7 / 1 day expiry alerts. Catches the disaster nobody ever monitors until it happens. Domain Hygiene category + /api/cron/whois-expiry
DNS change monitoring + drift alerts	DNS Spy, Domain Monitor	Scheduled re-scan diffs DNS records (A / MX / NS / TXT) and fires drift alerts. CT-log tail catches new cert issuance within ~60 seconds. Scheduled re-scan + /api/cron/dns-drift
MCP / llms.txt exposure	(none - greenfield)	llms.txt audit + MCP endpoint discovery + auth-header probe ship today; deeper MCP coverage staged in the registry. Agent Readiness category (live); MCP block (MCP_001-025) staged in the registry

To match Vysiro, you’d juggle…	Covers	Monthly	AI fix	Unified score	AI / MCP
PowerDMARC / EasyDMARC	Email auth only	$8-72	×	×	×
MxToolbox monitoring	DNS / email diagnostics	~$129	×	×	×
SSL Labs + SecurityHeaders	TLS + headers	Free (manual)	×	×	×
Attaxion / entry EASM	Asset discovery	~$129	×	×	×
MCP / AI-agent exposure	AI-agent surface	Can’t buy it	-	-	-
Vysiro Starter	All of the above · 162 checks	$29	✓	✓ 0-1000	✓

Domain & email security, scanned and fixed in 60 seconds.

Detect. Fix. Prove. In under 60 seconds.

Get your TrustScore

Other scanners hand you jargon. Vysiro tells you what it means.

One scan replaces your entire tool stack

Built for teams with no security hire.

Fix your deliverability

Pass the security review

Find your MCP exposure

Simple, transparent pricing

Free

Starter

Growth

MSP Partner

Enterprise

What you replace with $29/mo

Frequently Asked Questions

Stop Monitoring.
Start Fixing.