About MyDomainRisk-Scanner

What it is

MyDomainRisk is an external security-posture assessment service. A scan looks at what a domain shows to any visitor on the internet — its certificate, security headers, published email and DNS records, and public intelligence about it — and turns that into a plain-language report. Nothing is installed anywhere and nothing requires access to your systems. How we scan describes the full boundary.

How it identifies itself

Requests carry this user agent:

Mozilla/5.0 (compatible; MyDomainRisk-Scanner/1.0; +https://mydomainrisk.com/scanner)

If your site refuses the homepage or the plain-HTTP request, the scanner may repeat that one request once with a common browser user agent. The repeat still carries an X-MyDomainRisk-Scanner: https://mydomainrisk.com/scanner header, is signed in the same way, and still honours your robots.txt. A second refusal is reported as not checked, not as a problem with your site.

Requests are also cryptographically signed using HTTP Message Signatures (Web Bot Auth). The public key is published as a signed key directory at:

https://api.mydomainrisk.com/.well-known/http-message-signatures-directory

A request carrying Signature-Agent: "https://api.mydomainrisk.com" whose signature verifies against that key came from us. A request that only copies the user agent did not.

What it fetches

• The homepage (https://), and http:// with each redirect step it returns, to see whether and how it reaches https.
• A small number of well-known policy files: /.well-known/security.txt, /.well-known/gpc.json and the MTA-STS policy on the mta-sts subdomain.
• A handful of common privacy-policy paths, such as /privacy and /privacy-policy, to confirm a policy is published.
• The homepage of a small number of related hostnames found in public certificate records, when their DNS points at a hosted service that could be unconfigured.

Our scans use bounded, external, non-intrusive checks. They do not attempt exploitation, credential testing or intentional modification of target systems. Checks combine public records, third-party intelligence and bounded connections to public-facing services. They are not equivalent to a casual browser visit.

robots.txt

The scanner reads /robots.txt before fetching any page and does not fetch pages it disallows, whether the rule is addressed to MyDomainRisk-Scanner or to all agents. It honours Crawl-delay. Pages it may not fetch are shown in the report as not checked — never as a pass or a failure. Each redirected page uses its own origin's policy. If policy cannot be retrieved or its delay exceeds our collection budget, we do not fetch the page. Protocol endpoints are separate from page crawling. Requests can appear in logs or trigger alerts.

What it never does

• No crawling beyond the pages listed above. We do not follow links across a site.
• No forms submitted, no logins attempted, no credentials of any kind.
• No exploitation, fuzzing, fake-attack traffic or bulk requests. A scan makes a small, bounded number of requests to a site.
• No personal data of the person who requested the scan is sent to the site.

Blocking or contacting us

To stop the scanner fetching pages from your site, add a rule to your robots.txt:

User-agent: MyDomainRisk-Scanner
Disallow: /

Questions or concerns: support@mydomainrisk.com. Please include the hostname and the approximate time from your logs.