About MyDomainRisk-Scanner

What it is

MyDomainRisk is an external security-posture assessment service. A scan looks at what a domain shows to any visitor on the internet — its certificate, security headers, published email and DNS records, and public intelligence about it — and turns that into a plain-language report. Nothing is installed anywhere and nothing requires access to your systems. How we scan describes the full boundary.

How it identifies itself

Every request carries this user agent:

Mozilla/5.0 (compatible; MyDomainRisk-Scanner/1.0; +https://mydomainrisk.com/scanner)

Requests are also cryptographically signed using HTTP Message Signatures (Web Bot Auth). The public key is published as a signed key directory at:

https://api.mydomainrisk.com/.well-known/http-message-signatures-directory

A request carrying Signature-Agent: "https://api.mydomainrisk.com" whose signature verifies against that key came from us. A request that only copies the user agent did not.

What it fetches

• The homepage (https://, and http:// once to see whether it redirects to https).
• A small number of well-known policy files: /.well-known/security.txt, /.well-known/gpc.json and the MTA-STS policy on the mta-sts subdomain.
• A handful of common privacy-policy paths, such as /privacy and /privacy-policy, to confirm a policy is published.
• The homepage of a small number of related hostnames found in public certificate records, when their DNS points at a hosted service that could be unconfigured.

It also performs the ordinary network observations a visitor's browser or mail client would: a DNS lookup, a TLS handshake on port 443, and a connection attempt to a short list of common service ports to see whether they answer. Everything else in a report comes from public records and intelligence sources, not from your servers.

robots.txt

The scanner reads /robots.txt before fetching any page and does not fetch pages it disallows, whether the rule is addressed to MyDomainRisk-Scanner or to all agents. It honours Crawl-delay. Pages it may not fetch are shown in the report as not checked — never as a pass or a failure.

What it never does

• No crawling beyond the pages listed above. We do not follow links across a site.
• No forms submitted, no logins attempted, no credentials of any kind.
• No exploitation, fuzzing, fake-attack traffic or bulk requests. A scan makes a small, bounded number of requests to a site.
• No personal data of the person who requested the scan is sent to the site.

Blocking or contacting us

To stop the scanner fetching pages from your site, add a rule to your robots.txt:

User-agent: MyDomainRisk-Scanner
Disallow: /

Questions or concerns: support@mydomainrisk.com. Please include the hostname and the approximate time from your logs.