Transparency
What we query
A scan never sends traffic to the domain being assessed. This page lists every source we read, where each request goes, and what you will not see in your logs.
Sources
| Source | What we read | Where the request goes |
|---|---|---|
| Public DNS resolver | TXT, MX, NS, SOA, CAA, A and CNAME records, and DNSSEC validation state | Cloudflare's public resolver over DNS-over-HTTPS. The query goes to Cloudflare, which answers from its cache or asks your authoritative nameservers the same way every visitor's device does. |
| Certificate transparency logs | Hostnames and expiry dates on certificates issued for your domain | crt.sh, with Cert Spotter as a fallback. Both are public mirrors of the logs every certificate authority is required to publish to. |
| Domain registry (RDAP) | Registration expiry and transfer lock status | rdap.org, which forwards to the registry for your top-level domain. This is the successor to WHOIS. |
| Shodan | Open ports already indexed for the IPs your apex and www resolve to (Pro and Business) | Shodan's API. Shodan does its own internet-wide scanning on its own schedule; we read its index and never scan ourselves. |
| Have I Been Pwned | Count of accounts on your domain that appear in published breaches (Pro and Business) | HIBP's commercial domain search. Only the count and alias list reach us; we never receive passwords. |
| Hosting provider edge | Whether a resource behind a dangling CNAME is unclaimed (Pro and Business) | One HTTPS request to the provider the CNAME points at (GitHub Pages, Heroku, S3 and similar). That request reaches the provider's shared edge, which serves the hostname in the same way it would for any visitor. It is the only check that sends anything carrying your hostname, and it never reaches infrastructure you operate. |
Check by check
| Check | Records read | Source |
|---|---|---|
| DMARC | _dmarc TXT on the domain and its organizational parent for subdomain inheritance | Resolver |
| SPF | TXT on the domain, then every include and redirect in the chain, counting the DNS-querying mechanisms | Resolver |
| DKIM | Known selector names for the sending providers we infer from your MX hosts and SPF includes | Resolver |
| MTA-STS and TLS-RPT | _mta-sts and _smtp._tls TXT records | Resolver |
| DNSSEC | The AD flag on the SOA answer | Resolver |
| CAA | CAA records on the domain | Resolver |
| MX | MX records and the providers behind them | Resolver |
| Nameservers | NS records on the organizational domain | Resolver |
| Registration | Expiry and status codes | RDAP |
| Certificate expiry | Newest logged certificate for the apex or www | CT logs |
| Exposed subdomains | Every hostname in the logs, then an A query for sensitive-looking names to see if they still resolve | CT logs, resolver |
| Lookalike domains | A, MX and NS records for a few hundred generated typosquats of your brand | Resolver |
| Exposed services | Indexed ports for resolved IPs | Shodan |
| Leaked credentials | Breached account count for the domain | HIBP |
| Subdomain takeover | CNAME targets from the logs, then the provider's response for the hostname | Resolver, provider edge |
What we never do
- Port scans or service probes against your IP addresses
- Login attempts, password sprays, or credential testing
- Test emails, mail relay checks, or SMTP connections to your MX hosts
- DNS zone transfer (AXFR) requests to your nameservers
- Vulnerability scanners, web crawlers, or fuzzing against your web servers
- Anything that requires credentials, an agent, or a firewall rule
What you will see in your logs
Nothing from us. Your authoritative nameservers may see ordinary recursive queries from Cloudflare's resolver, indistinguishable from any other lookup on the internet. Your web servers, mail servers, and firewalls receive no connection.
When a source is unreachable during a scan, the check is marked not measured rather than guessed, and it never raises an alert.