Verifying a domain for deep scans

Basic scans read what a site already shows everyone: DNS, email records, certificates, headers and pages. They run on any domain, signed in or not.

Deep scans go further. They test open ports, look for known vulnerabilities and probe for exposed private files, which is the same traffic an attacker's scan sends. So they run only on a domain you have verified you own. That is decided per domain: verifying one domain does not clear the others.

A domain counts as verified when any one of these is true:

You proved it with an email link, a DNS record or a file (below). It covers the domain and its subdomains for 90 days, and a DNS record or file you leave in place renews itself.
Your verified sign-in email is at it. Signing in as you@yourcompany.com and verifying that address already counts for yourcompany.com. A free or ISP mailbox (Gmail, Outlook, iCloud, Comcast and similar), Apple's Hide My Email relay, a disposable inbox, or a school or government address does not.
We approved your account for deep scans of any domain. That is for people who look after sites they cannot verify themselves, like an IT provider's clients. Ask for it in the app (Account, Scan access) or from the verify window on the web.

How to verify

Open the domain. While deep scans are off, the top of its page says so with a Verify you own it button (web and iPhone). Pick whichever is easiest:

Way	What you do
Email me a link	Pick an address at the domain you can read. We list the likely ones (your own address there, admin@, webmaster@, postmaster@, hostmaster@). Click the link in the email within 24 hours.
Add a DNS record	Add a TXT record. We name your DNS host from the domain's nameservers and link to its DNS settings, and every value has a Copy button. The Name / Host box takes `_domainguard-scanverify`; if your host wants the full name, it is `_domainguard-scanverify.<domain>`.
Upload a file	Put a small text file at `https://<domain>/.well-known/domainguard-verify-<token>.txt`. The web dashboard has a Download button for it.

You don't have to come back and press anything. While the window is open it checks every 20 seconds, and after you close it we keep looking every few minutes for a week. When we find the record or file, Alerts says the domain is verified and deep scans start.

A free mailbox never clears a domain by email link, because it proves the inbox, not the domain. The inbound-email method (send a blank message to the unique address shown) is offered only when the domain has a healthy SPF record, and the message counts only when it passes SPF for that exact domain and carries a DKIM signature from the domain itself.

What you see when a deep scan is refused

Scan tab (iPhone): a full scan of an unverified domain says so and offers Verify you own it, adding the domain to your account first if it isn't there. A quick scan always works.
Web, Run a check: the deep security scan's button reads Verify first until the domain is verified.
API/MCP: 403 domain_verification_required, from a full on-demand scan or a deep vulnerability scan.

API and MCP

GET/POST /api/domains/:id/verify-ownership (read the challenge, or check now), POST /api/domains/:id/verify-ownership/email (send the link), GET/POST /api/domains/verify-ownership (bulk); tools get_scan_ownership_verification, verify_scan_ownership, request_ownership_email_link, verify_scan_ownership_bulk, get_scan_clearance_status. GET /api/scan-access lists each domain with whether deep scans are on and why; POST /api/scan-access/request (optional reason) asks us to approve deep scans of any domain.

Protected targets

Some domains are refused as scan targets even on an approved account: major banks and payment networks, government, military and education TLDs, and the largest platforms, retailers, telecoms, airlines, insurers, hospitals and media sites. A customer who genuinely owns one proves it per domain, and the block lifts for that domain only. The response code is scan_target_blocked with protected_target: true.

Authorisation for a client's domain

A consultancy testing a client's site may be authorised without being able to publish a record there. POST /api/scan-authorizations (tool request_scan_authorization) files a request with the reason and a contact; an operator approves or declines, and GET /api/scan-authorizations/:domainId (get_scan_authorization) shows whether an authorisation is active.

Common questions

I verified one domain but another still says deep scans are off. Each domain is verified on its own, unless it sits under your verified work email's domain or the account is approved.

I sign in with Gmail. Can I scan? Yes. Basic scans work on any domain. For deep scans, verify the domain with an email link, a DNS record or a file.

Does verification expire? A proof lasts 90 days. A DNS record or file you leave in place is re-checked and renewed automatically; an email link has to be clicked again.

Why are basic scans open but deep ones not? A basic scan only reads what a site already serves. A deep scan probes it, and we won't do that to a site whose owner didn't ask.