Questions and answers

Four areas, each graded and combined into an overall A to F:

• Email security: mail servers, SPF, DKIM, DMARC, MTA-STS and BIMI.
• Website security: the certificate, HTTPS and security headers such as HSTS and Content Security Policy.
• Domain health: registration, DNSSEC and CAA.
• Impersonation risk: look-alike domains someone could use to fool your customers.

No. Nebby reads public DNS records and loads your public homepage, the same things any mail server or browser sees. It never logs in, never probes ports and never changes anything.

Yes. Everything it reads is public. IT providers use it to check prospects and clients. Please don't use the results to harass anyone; see the Terms.

Each check reports what it found and why. A few things can't be seen from outside, for example a DKIM key at an unusual selector. When Nebby can't confirm something, it says so instead of guessing.

DNS changes can take up to an hour to be seen everywhere, sometimes longer if the old record had a long TTL. Nebby also reuses a scan from the last 15 minutes. Wait an hour, then scan again. On Starter or Pro, open the domain on your dashboard and click Rescan now (or Rescan all now on the dashboard). Fresh results show up in about 2 minutes.

Monitored domains are rescanned every week, and you can rescan any time from the dashboard. On Pro, the daily watch also checks every day for changes to nameservers, mail servers, SPF, DMARC and DNSSEC, plus certificate and domain expiry and new lookalike domains.

Your registrar has a DS record that doesn't match the keys at your DNS host, or the host stopped signing. Resolvers that check DNSSEC, which is most of them, then refuse to answer for your domain, so your website and email are unreachable for many people. It usually happens after moving DNS to a new host. The quickest fix is deleting the DS record at your registrar. You can turn DNSSEC back on properly afterward. The Fix Kit has the exact steps.

Usually the policy is p=none. That only monitors: spoofed mail still gets delivered. Once your real mail passes SPF or DKIM, move to p=quarantine, then p=reject. The Fix Kit walks through that order safely.

A domain can only have one SPF record, and two break both. Combine them into one: keep a single v=spf1 at the start, list every include: once, and end with one -all or ~all.

Nebby looks for the selectors the big providers use. If your provider uses a custom selector, Nebby can't see it from outside and you can ignore that finding. For Microsoft 365, DKIM is switched on in the Defender portal under Email authentication settings.

Yes. Yinzer IT does this as a small consulting job. Email [email protected] or call 412-475-8085.

Every fix for your domain, in the order to make them: the exact records to paste, steps for your DNS host and email provider, a safe DMARC rollout, and how to check each one worked. It stays in your account.

You need to be able to sign in to wherever your domain's DNS is managed, such as GoDaddy, Cloudflare or Network Solutions. The steps are written for that screen. If you'd rather not, we can do it for you.

No, each kit is written for one domain. IT providers with many domains are better served by Nebby Starter or Pro.

Starter ($49/mo): 25 monitored domains, weekly checks, email alerts, white-label PDF reports and bulk scans of up to 500 domains a month.

Pro ($99/mo): 250 domains, daily watch for DNS changes, look-alike domains and expiring certificates, monthly client scorecards, Tenant Checkup for 25 Microsoft 365 tenants, 25 Policy Packs for clients, Teams, Slack and webhook alerts, ConnectWise, Autotask and Zendesk tickets, DMARC report processing, a team of up to five, and an API.

Yearly plans are $499 and $999.

Go to Branding in your dashboard. Add your company name, contact line, website, accent color and logo (PNG or JPG). Every PDF and report email after that carries your brand instead of ours.

On Pro, turn on monthly scorecards for a domain and enter the client's email at that domain. They get a short branded report on the 1st of each month, and every one has a link to stop them.

Mailbox providers like Gmail and Microsoft send a daily summary of every server that sent mail as your domain and whether it passed. On Pro, add Nebby's report address to a domain's DMARC record (DMARC reports, in your dashboard, shows the exact text) and Nebby lists each sending service, its pass rate and what to fix. You get an alert when a new server starts failing DMARC as your domain. It's the safe way to find every legitimate sender before moving to p=reject.

Yes, on Pro. Under Alerts, add ConnectWise PSA, Autotask or Zendesk with an API user's keys. Each alert opens a ticket with the details and a link back to Nebby, against the client company you map to that domain. The same alert opens at most one ticket a day. Keys are stored encrypted and never shown again.

Yes. Email us and we'll switch you, or cancel and choose the other plan when the current period ends.

Yes. The Tenant Checkup plan is for one business checking its own Microsoft 365: a weekly read-only health check of your whole tenant (security, conditional access, admins, licenses, devices, sharing and Secure Score) with a graded report and the fixes, plus your own domain checked every week with its Fix Kit included. It's $29 a month. IT providers looking after several clients get 25 tenants with Nebby Pro.

Read-only access through an app called "Yinzer IT Tenant Checkup". It can read directory and policy settings, sign-in activity, authentication methods and mailbox forwarding rules. It can't change anything or read anyone's email.

A Global Administrator of the Microsoft 365 tenant being checked. Clicking Connect sends you to Microsoft's approval page; sign in there as that tenant's admin. If you manage a client, they can do this step themselves.

Microsoft only shares sign-in activity, used to find forgotten accounts, with tenants that have Entra ID P1 or higher (included in Microsoft 365 Business Premium). Without it, those checks say so instead of guessing.

Disconnect the tenant in Nebby, then in the Entra admin center go to Enterprise applications, open "Yinzer IT Tenant Checkup", choose Properties and Delete. Full steps: removing access.

Five documents written from your answers: a Written Information Security Program, an Acceptable Use Policy with staff sign-off, an Incident Response Plan with playbooks, an Access Control and Authentication Policy, and a Remote Work and Device Policy. Each comes in Word to edit and PDF to sign.

No. They're templates and guidance. Laws and insurer requirements differ by state and industry, so have someone qualified review them before you rely on them.

Yes, any time. The documents update and get a new version number. Once a year, record your review and they get a new effective date. We email a reminder a month before it's due.

Yes. Nebby Pro includes 25 Policy Packs for clients, with your branding on the cover.

Enter your email on the sign-in page and we send a link that works once, for 20 minutes. Use the same email you bought with.

Check spam or junk for a message from [email protected], then try again after a few minutes. Still nothing? Email us from that address and we'll sort it out.

Lemon Squeezy, our reseller and merchant of record. They take the card, handle tax and send receipts; we never see your card number. Update your card or download invoices in the billing portal linked from your account page.

On your account page, choose "Turn off auto-renew". Your plan keeps working until the end of the period you paid for, then stops. No fees.

It's in the Terms of Service, section 4.

No. Running a scan never puts you on a list. Details: privacy notice.

Only your account and, on Pro, the team members you add. Reports you send to clients go only to addresses at that client's domain.

Email [email protected] from the address on the account and we'll delete it, except what tax rules require us to keep.