Vulnerabilities and exposure
Scan clearance and ownership proof
Prove you control one domain on the account (DNS record, file, or an email link) and every domain is cleared for 90 days. Protected targets and authorisation.
Updated · 3 min read
Active scanners send requests a site owner did not invite, so DomainGuard runs them only for an account that has shown it owns what it scans. The rule since 2026-09-10 is account-level, one domain: prove control of any one domain on the account and every domain it monitors is clear.
What needs clearance
Vulnerability scans beyond the Quick profile, port scans, the exposed-files probe in the security checkup, whole-domain breach monitoring, and the one-off custom probe. Reading public records (DNS, RDAP, certificate logs, headers) never does.
The three proofs
| Method | What to publish |
|---|---|
| DNS | A TXT record at _domainguard-scanverify.<domain> with the token shown |
| File | A file at https://<domain>/.well-known/domainguard-verify-<token>.txt containing the token |
| A one-click link sent to an address at the domain: postmaster@, admin@, or your own mailbox there. Free-mail addresses (gmail, yahoo and similar) prove the mailbox, not the domain, so they never clear an account |
The email path is offered only when the domain has a healthy SPF record, and the link is accepted only when the message arrives with SPF passing for an envelope sender on that exact domain.
A proof lasts 90 days and is re-checked on demand. A verified sign-in address at one of the account's own domains also counts.
Where
- Web: Security, Scan clearance; or the "Prove you own it" step in a domain's setup guide.
- iOS: the setup guide step, with the exact record and a Copy button.
- API/MCP:
GET/POST /api/domains/:id/verify-ownership,POST /api/domains/:id/verify-ownership/email,GET/POST /api/domains/verify-ownership(bulk); toolsget_scan_ownership_verification,verify_scan_ownership,request_ownership_email_link,verify_scan_ownership_bulk,get_scan_clearance_status.
Protected targets
Some domains are refused as scan targets even on a cleared account: major banks and payment networks, government, military and education TLDs, and the largest platforms, retailers, telecoms, airlines, insurers, hospitals and media sites. A customer who genuinely owns one proves it per domain, and the block lifts for that domain only. The response code is scan_target_blocked with protected_target: true.
Authorisation for a client's domain
A consultancy testing a client's site may be authorised without being able to publish a record there. POST /api/scan-authorizations (tool request_scan_authorization) files a request with the reason and a contact; an operator approves or declines, and GET /api/scan-authorizations/:domainId (get_scan_authorization) shows whether an authorisation is active.
Common questions
I proved one domain but another still says "ownership proof needed". Refresh. The iOS app read per-domain proof until the 2026-09-12 build; the server has been account-level since 2026-09-10.
Does proof expire? After 90 days. The clearance status page and the setup guide say when.
Why is this stricter than the free tools? The public checkup only reads what a site serves. Anything that probes is behind proof, because the public tools cannot be a scanner-for-hire against someone else's site.
Keep reading
Related articles
- The domain setup guideThe per-domain checklist computed from what is actually set up: first check, alerts, email records, DMARC reports, ownership proof, monitoring and more.Getting started ·Updated
- Domain health scanWhat the domain scan reads (DNS, nameservers, DNSSEC, the registrar record, expiry) and how the registration expiry notices are timed.Domains ·Updated
- Managed email authenticationDelegate your DMARC record to DomainGuard with one CNAME so the policy can be advanced without further DNS edits, and let DomainGuard flatten your SPF.Email authentication ·Updated