8 free security tools for IT teams: CVE, DMARC, SPF, DKIM and MX checks (no sign-up)

Drafted with AI assistance. Every tool and link below was checked on the live site before publishing.

Most security checks don't need a paid product or a sales call. They need public data, read correctly, and an answer you can act on. Over the last few weeks we built eight free tools that do exactly that. None of them needs an account.

Here is what each one is for, a 10-minute routine that uses them, and what changed in Varaxon Scan Hub this month.

Vulnerability checks

1. CVE checker: is this CVE being exploited right now?
Paste a CVE ID and get three answers at once: whether it is on CISA's Known Exploited Vulnerabilities (KEV) catalog, its EPSS score (the chance of exploitation in the next 30 days) and its CVSS severity, with a plain-English verdict on how urgently to fix it. Use it when a new CVE hits the news, or when a scan report hands you 400 "Critical" findings and you need to know which ones attackers actually use.

2. Free pre-flight check: will your scan export work?
Upload an export from your vulnerability scanner and see what Scan Hub can read from it before you spend anything. No account needed.

Email security checks

3. Email security check: can someone send email pretending to be you?
One check covers SPF, DKIM, DMARC, lookalike domains and up to three suppliers, then grades the domain A to F and lists the exact DNS records that would raise the grade. It takes about 20 seconds.

4. SPF checker
Shows your SPF record and catches the usual mistakes, such as more than 10 DNS lookups or duplicate records. Each problem comes with the exact fix.

5. DKIM checker
Finds the DKIM keys your domain publishes, checks their length, and explains how to switch signing on if it is missing.

6. DMARC checker
Shows your DMARC policy and, in plain words, whether email that fakes your domain is rejected, quarantined or delivered anyway.

7. DMARC record generator
Pick a policy and a reporting address, then copy a valid DMARC TXT record. It includes plain advice on moving safely from p=none to p=reject.

DNS

8. MX lookup: who receives email for a domain?
Lists the mail servers for any domain, who hosts them, and whether SPF and DMARC are set up. It's handy before a migration, or when you're vetting a supplier's email.

All eight are in one place at varaxontech.com/free-tools.

A 10-minute routine for your own domain (or a client's)

1. Run the email security check and note the grade.
2. If SPF fails, open the SPF checker and fix the record it flags first. Lookup-limit errors silently break SPF for every message.
3. If there is no DMARC record, build one with the generator at p=none with a reporting address, and calendar a move to quarantine once the reports look clean.
4. Take the three newest CVEs from your last scan or patch notes and run them through the CVE checker. Anything on KEV moves to the top of this week's list.
5. Rerun the email check after DNS has updated and keep the before and after grades. That's your evidence.

What's new in Scan Hub

Varaxon Scan Hub turns the export from the vulnerability scanner you already use into a client-ready report, ranked by what attackers actually exploit (CISA KEV, VulnCheck KEV and EPSS) rather than severity alone. It's scanner-agnostic: it reads exports from network, host and web vulnerability scanners, and it can also connect to Microsoft Defender or ConnectSecure. Code decides the facts, and AI only writes the plain-English explanation from them.

Recently added:

• Proof of fix in every report: a "Since the last scan" section showing what was fixed, what came back and what's new, system by system.
• Fix deadlines and signed risk acceptance: due dates from each finding's priority (or the CISA KEV due date when that's sooner), a past-due list per client, and a one-time link for a client to sign off on a risk they choose to accept.
• Proof packs: a white-label PDF of up to a year of fixes, open items and accepted risks, for audits, insurers and renewals.
• Tickets: after you review a report, Scan Hub can push the fixes into ConnectWise PSA or HaloPSA as tickets.
• The free tools above, now with their own hub page.

The full rundown is in What's new in Scan Hub: October 2026.

Try it free for 14 days

Every new account gets a 14-day free trial of Core: up to 10 reports, 3 team members and every feature. No credit card is needed, and there's no automatic charge when the trial ends. You pick a plan, or buy single reports, only if you want to.

Start the free trial or look at sample reports first.