About the SecVaultAudytor robot
SecVault Auditor checks domains at the request of a user. It does not crawl the internet on its own, does not scan ports and does not try to log in.
What it does during one audit
- DNS queries (MX, TXT, A/AAAA, NS, DS, CAA and common DKIM selectors) through public resolvers.
- Up to 25 HTTP requests: the home page (http and https), robots.txt, sitemap.xml, /.well-known/security.txt and the MTA-STS policy. Each request carries the User-Agent header shown below.
- A connection to the MX mail server on port 25 (at most two servers): EHLO and STARTTLS, no message is sent. This is the only port besides 80 and 443 we connect to, and only on the server named in the MX record.
- A query to the domain registry (RDAP) for the expiry date, and to public certificate logs (Certificate Transparency) for subdomain names.
- A DNS check whether look-alike names of the domain are registered. The robot visits at most three such domains like an ordinary visitor: one request for the home page (within the request limit above) and a registry query for the registration date. It compares the title and text with the audited site, sends nothing and does not store the content of the other site.
What it does not do
- It does not scan ports and does not look for vulnerabilities by trial and error.
- It does not try to log in, does not submit forms and does not send mail to addresses in the audited domain.
- It does not guess hidden files or directories. Checks of sensitive paths (backups, configuration files) are switched off; we will run them only for domains whose owner confirms ownership with a DNS record.
Full list of 69 checks with weights: methodology.
Data
We keep results of free scans for 90 days, IP addresses only as a shortened daily hash (used for rate limits), and your email address only if you give it. Details are in the privacy policy.