Three free checks for your domain. I pointed them at mine first.

The tools told me my domain had no HSTS, no automatic redirect to HTTPS, and — worse — my transfer lock was off. All three were true. I fixed them before publishing this.

That is the point. Most Kenyan businesses have never seen this layer of their own operation, and most tools that show it are attached to someone selling you something. These three are free, need no sign-up, and read only public records.

1. Can someone send email pretending to be your business?

The email security check reads your published SPF, DKIM, DMARC and MX records and explains, in plain English, what they do — and what they do not prove. Over 100 parastatal chief executives faced action over exactly these records.

2. Is your business name protected in .ke as well as .co.ke?

The domain search checks the extension you enter alongside its .ke twin. For a domain already taken, it shows who the registrar is, whether the transfer lock is on, and when it expires. One domain I checked while testing expired 78 days ago and is still unlocked.

3. What does your domain show the public?

The readiness scan produces a Public Signal Score across six dimensions — control, trust, speed, conversion, resilience, agent readiness — with an honest Evidence Coverage figure showing how much of the picture is actually visible from outside. Anything that cannot be observed publicly is marked as such, and never counts for or against you.

None of these prove your business is secure. They show what is visible and what is missing, so you can decide what to fix first — and who should fix it. The limits of each tool are documented on the tool limitations page.

Disclosure: registration links in the domain search go to HOSTAFRICA, where I am Managing Director of the Kenyan business. Onduu earns no commission on them.