Skip to content
Keel Docs

Automated checks

Automated checks re-test a public domain on a schedule. Each check keeps a dated pass and fail history, which is something you can show an auditor. A screenshot only shows that the setting was right on the day it was taken.

What a check tests

Section titled “What a check tests”

Checks are read-only and need no credentials, only a public domain.

Check What it confirms
HTTPS / TLS reachable The host serves HTTPS with a valid, trusted certificate.
Security response headers The site sends Strict-Transport-Security, and reports on CSP, X-Content-Type-Options and X-Frame-Options.
SPF record present The domain publishes an SPF record.
DMARC policy present The domain publishes a DMARC policy at _dmarc.

Add a check

Section titled “Add a check”

Pick a check type, enter the domain, and optionally enter the key of the control it backs. The check runs on the next scheduled sweep, or press Run now. Auditors can see checks but cannot add, run, pause or delete them.

How checks become evidence

Section titled “How checks become evidence”

When a check is linked to a control, a pass files a dated evidence item against that control. A fail or an error withdraws that item, so the evidence is proven again on every run instead of going stale.

  • A check with no control linked files no evidence.
  • A control key that matches no control in the workspace files no evidence, and the check’s row says so.
  • Pausing a check withdraws its evidence. Resume it to start filing again.

When checks run

Section titled “When checks run”

The scheduled sweep runs every six hours. Run all checks now re-tests up to 25 enabled checks straight away and adds each result to its history. Use it after you fix a DNS record or a header, so you don’t have to wait for the next sweep.

Each check’s History shows its most recent runs.

Next steps

Section titled “Next steps”