SOC 2 domain security check
For SOC 2 readiness and Type II evidence: check the public side of a service against the common criteria in one run, and re-run it through the audit period to show the controls kept working.
What this check covers
Each check below names the SOC 2 criteria it supports.
Email sender authentication
SPF, DKIM and DMARC records, policy strength and alignment, BIMI
Stops others sending email that claims to be you. A DMARC policy of quarantine or reject is the evidence; p=none is monitoring only.
Email in transit
MTA-STS, TLS-RPT, DANE and STARTTLS on every MX
Shows mail between servers is encrypted and can’t be quietly downgraded to plain text.
Web encryption
Certificate validity, chain, expiry, protocol versions and HSTS
Evidence that data to and from the website uses current, strong cryptography and that certificates are managed before they expire.
Website hardening
Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy), redirects, HTTP to HTTPS
Secure configuration applied to the public face of the organisation, and a baseline to detect drift against.
DNS integrity
DNSSEC chain of trust, CAA records, lame or open nameservers
Protects the name everything else depends on from spoofing, and limits who can issue certificates for it.
Resilience
Nameserver count and diversity, SOA timers, MX redundancy, propagation from many regions
One nameserver or one mail server is a single point of failure. Redundancy here supports continuity plans.
Exposed services
Common ports open to the internet, from outside the network
Remote desktop, databases and admin panels facing the internet are the usual way in. Outside-in evidence the boundary does what the policy says.
Reputation
Domain and mail server IPs on spam and threat blocklists
A listing is often the first sign of a compromised mailbox or server.
Domain ownership
Registrar, expiry date, transfer lock, registrant privacy
An expired or unlocked domain can be lost or hijacked. The registrar is a supplier like any other.
Attack surface
Subdomains seen in certificate logs and DNS, dangling records
You can’t protect what isn’t on the asset register. Old subdomains pointing at deleted cloud resources can be taken over.
This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.
Guides for auditors
All guidesQuestions
External evidence for SOC 2 common criteria: encryption in transit (CC6.7), boundary protection (CC6.6), configuration monitoring (CC7.1) and availability (A1.2), from one domain check.