Bounded requests
Collection limits constrain each check. Repeated or concurrent scans still generate traffic, including across domains that share infrastructure.
Non-intrusive external scanning
How we scan: non-intrusive by design
We observe; we don't touch
Trusting a security tool means knowing exactly what it does — and what it will never do. This page is that contract, in plain English.
The short version.
Every check looks only at what a domain already shows the public internet. Nothing is installed, nothing is logged into, nothing is attacked. That is why a check needs no access, no agreement and no agent: it reads what is already published, causes no disruption, and changes nothing.
The principle
One rule decides what is in a scan and what is not.
Every MyDomainRisk check is a non-intrusive external observation. We look at what a domain already shows to the public internet — its DNS records, its certificates, the headers its website sends, what public threat-intelligence sources say about it. Website protocol checks complete a small, bounded set of TLS handshakes without sending application data. They do not enumerate ciphers or attempt exploitation. Collection records for DNSSEC, disclosure files and cloud storage distinguish completed, incomplete and unavailable checks; completed collection is not a security pass. Historical reports retain their original evidence. RPKI routing intelligence is currently unavailable. Published vulnerability intelligence adds context without sending additional probes to the target.
The same holds at portfolio scale
The question every MSP and multi-domain owner asks before turning on scheduled monitoring.
Clear scope
The scan description explains the checks we perform; it is not a blanket assurance about permission or a target system's response.
Non-intrusive checks
We do not attempt exploitation, credential testing or intentional modification of target systems.
A weekly scan puts no more load on any one domain than a search engine visiting the homepage.
What a scan looks at
Eight categories of publicly visible signal. All of it is information the domain already publishes.
1
DNS resilience and mail-server coverage
Pro/MSP full scans sample up to six advertised nameservers and two parent servers, plus up to five mail servers at one public address each. Dated evidence cards show DNS responses, mail TLS and supported authenticated DANE certificate bindings. Missing responses remain unverified. Matching responses do not prove independent infrastructure or continuous availability. No email is sent; Free scans and daily monitoring skip these advisories.
2
Certificates & encryption
Certificate validity and expiry, plus bounded TLS 1.0–1.3 handshakes on website port 443 on every plan. Unavailable probes remain unverified; this does not enumerate ciphers or certify the configuration.
3
Email protection
Published email records, observed DKIM key structure, and MTA-STS policy syntax and mail-server matching. DNSSEC validation is reported separately from signing-record presence. Unavailable evidence remains unverified; these checks do not test actual message authentication.
4
Web security headers
The protective HTTP headers your site sends with every page.
5
Internet exposure
Published service and vulnerability observations, supplemented by bounded connection checks. Dated known-exploitation intelligence helps prioritise reported vulnerabilities without claiming compromise or changing the domain score. Where observed versions match the limited lifecycle coverage, reports show dated upstream support context. Distribution backports, extended vendor support and installed patch status remain unverified. This adds no target requests.
6
Infrastructure locations
Pro/MSP Network Map includes a mobile-friendly list and expandable map of observed website, email and DNS IP locations, with lookup dates, country borders and zoom/pan controls. Locations are approximate: CDN, proxy and anycast addresses may represent an edge, not the origin. Physical server locations and data residency remain unverified. Missing locations stay unknown. This adds no target requests and does not change the security score.
7
Domain hygiene
Registration expiry, transfer locks and DNS configuration. Pro/MSP full scans automatically review up to 50 related hosts per scanned domain using public certificate records and bounded DNS/HTTPS checks. Daily monitoring skips that review. Discovery is incomplete and indicators need ownership review; they do not confirm takeover or change the main score.
8
Lookalike domains
Registered domains that imitate yours — the raw material of phishing against your customers and staff.
9
Threat intelligence
Whether your domain, infrastructure, or employee credentials appear in trusted public and commercial threat feeds.
10
Compliance surface
The externally verifiable subset of GDPR Article 32, PCI DSS, and related baselines — formatted as evidence for auditors.
What we publish, and what we don't. Findings are explained in plain English with practical fix steps — we tell you what we found and why it matters, not the internal mechanics of how results are weighted. Those stay private for the same reason a bank doesn't publish its fraud rules.
How a good result relates to recognised standards
We compare the scan's externally visible checks with current guidance and transparent security benchmarks. A good result is useful evidence that your public domain follows many of the same technical expectations; it is not certification, a compliance decision or a replacement for internal testing.
Comparative analysis last reviewed: 17 August 2026
Close means broad coverage of the same external surface. Strong overlap means many shared checks within a narrower specialist benchmark. Supporting evidence means selected requirements only, and Limited means only a small externally visible part of a much broader framework.
- Shared ground
- Broad coverage of the same externally visible domain and attack-surface concerns.
- What remains outside the scan
- NCSC also covers wider asset and supplier discovery. We assess the domains you choose, not a complete organisation-wide inventory.
Internet.nl (opens official source in a new tab)
Strong overlap- Shared ground
- TLS, security headers, DNSSEC, email authentication, CAA and security.txt.
- What remains outside the scan
- Internet.nl promotes modern internet standards and includes areas such as IPv6 and DANE. Its grade is not interchangeable with ours.
- Shared ground
- CSP, HSTS, clickjacking, content-type, referrer-policy and cookie safeguards.
- What remains outside the scan
- Observatory is a specialist HTTP-header benchmark and tests some cases our broader domain scan does not reproduce.
Qualys SSL Labs (opens official source in a new tab)
Strong overlap- Shared ground
- Certificate validity and trust, protocol versions, weak encryption and HTTPS transport.
- What remains outside the scan
- SSL Labs performs deeper specialist TLS grading. A MyDomainRisk result is not an SSL Labs grade.
Cyber Essentials v3.2 (opens official source in a new tab)
Supporting evidence- Shared ground
- Public service exposure, secure configuration and visible vulnerability or software-update risk.
- What remains outside the scan
- Endpoints, user access, malware protection, internal networks and the certification assessment are outside an external domain scan.
PCI DSS 4.x (opens official source in a new tab)
Supporting evidence- Shared ground
- Public encryption, exposed services and externally visible vulnerability signals.
- What remains outside the scan
- PCI DSS requires wider cardholder-data-environment evidence. We are not an Approved Scanning Vendor and cannot establish compliance.
CIS Controls v8.1 (opens official source in a new tab)
Supporting evidence- Shared ground
- External asset review, secure configuration, vulnerability management and email authentication.
- What remains outside the scan
- Many CIS safeguards require internal inventory, processes, endpoint controls and authenticated scanning.
- Shared ground
- Secure communications and some browser-facing configuration controls.
- What remains outside the scan
- Application logic, authentication, authorisation, sessions and data handling require dedicated application testing.
- Shared ground
- Evidence for external asset awareness, protective configuration and continuous monitoring.
- What remains outside the scan
- Most Govern, Identify, Protect, Detect, Respond and Recover outcomes require organisation-wide evidence.
- Shared ground
- Evidence that selected internet-facing technical risks are identified and monitored.
- What remains outside the scan
- ISO 27001 is an organisation-wide management-system standard. A domain scan cannot assess its governance, people or audit requirements.
What we never do
This list is a commitment, not a description of current limitations.
- No software installed on your systems — ever. There are no agents.
- No credentials accepted, tested, or guessed. We never ask for passwords and never attempt a login.
- No exploitation. We observe that a door exists; we never try the handle.
- No payload delivery, fuzzing, or fake-attack traffic.
- No brute-force discovery — subdomains come from public certificate-transparency logs, not guessing.
- No intrusive crawling. We fetch the kinds of public pages any visitor or search engine already fetches.
- Page requests, including redirects, respect the destination's robots.txt. Disallowed pages are skipped. If the policy cannot be retrieved or its delay exceeds the collection budget, we do not fetch the page; missing evidence is not a pass or a failure.
- External does not mean invisible: bounded DNS queries, TLS handshakes, public-page requests and service connection checks can appear in logs or trigger monitoring alerts. Protocol endpoints are separate from page crawling.
Anything deeper — and there's very little we'd ever add — would be separate, clearly labelled, opt-in, and gated behind verified proof that you own the domain. It would never be quietly added to the standard scan.
Every request identifies itself as MyDomainRisk-Scanner and is cryptographically signed, so a site operator can verify it really came from us. About our scanner has the exact user agent, what it fetches, and how to block it.
Honesty about limits
External observation cannot see everything, and we would rather say so.
What a scan cannot see
We don't assess your internal network, your endpoints, your staff practices, or anything behind a login. A scan is one view of your risk, best used alongside internal reviews and penetration testing.
What a clean result means
That nothing malicious was visible to our checks at the time of the scan. No verdict from any tool, ours included, is a guarantee. Use results to inform judgement, not to replace it.
Who's behind it
MyDomainRisk is built and operated by Huro Data Technologies Ltd., a UK company — self-sustaining on subscriptions, not venture-funded, with no advertising, no data sales, and no resale of your information. Data handling is documented in our privacy policy and GDPR commitment; security researchers can find our vulnerability disclosure policy here.
The best proof is a real scan
The checker on our homepage runs genuine checks with no account, and shows exactly the kind of findings a full scan produces. Or browse a sample report first to see how a full scan reads.