Skip to main content
Scanner Transparency & Control

About the Scanner

SurfaceScan operates strictly as a lightweight, read-only observer of public web configuration. This page documents our exact network footprint and how site owners can opt out at any time.

Scanner Identity

Every outbound HTTP/HTTPS connection initiated by SurfaceScan identifies itself transparently with the following header and connection profile:

Exact User-Agent header SurfaceScan/1.0 (+https://surfacescan.uk/about-scanner)
Allowed network destinations Public IPv4 / IPv6 on ports 80 & 443 only
Request limits 5s timeout · 1 MB body cap · max 4 hops

Every Request the Scanner Makes

A single audit executes only the following read-only network operations against a domain and its public registries:

  1. DNS lookups: Queries standard authoritative records (A, AAAA, MX, TXT, CAA, CNAME), checks _surfacescan.<domain> (up to 4 parent lookups) for opt-out directives, resolves recursive SPF includes, and probes 10 common DKIM selectors (<selector>._domainkey.<domain>).
  2. One TLS handshake on port 443: Opens a single guarded TLS connection with Server Name Indication (SNI) to read certificate expiry, chain validity, protocol version, and public key size.
  3. GET / over HTTPS: Fetches the apex page once to evaluate security response headers, cookie attributes, CORS headers, and third-party <script> SRI attributes.
  4. GET http://<domain>/ without automatic redirects: Checks whether plain HTTP returns a permanent redirect (301 / 308) to HTTPS without following redirect chains automatically.
  5. GET /robots.txt: Checks if a public crawler instruction file is present over HTTPS.
  6. GET /.well-known/security.txt: Checks for a valid, non-expired RFC 9116 vulnerability disclosure contact policy.
  7. Certificate Transparency lookup (crt.sh): Queries public certificate logs to identify subdomains and flag dangling CNAME records prone to subdomain takeover.
  8. DNS-over-HTTPS (Cloudflare): Queries cloudflare-dns.com with do=true to inspect the DNSSEC Authenticated Data (AD) flag.
  9. RDAP lookup (rdap.org): Queries public Registration Data Access Protocol records (following authoritative registry redirects) to read the domain registration expiration event.

What SurfaceScan Never Does

  • No port scanning: Never probes ports other than HTTP (80) and HTTPS (443).
  • No exploit attempts: Never tests vulnerabilities, sends fuzzing strings, or executes XSS/SQLi payloads.
  • No brute force: Never attempts credential stuffing, password guessing, or rate-limit evasion.
  • No secret file guessing: Never enumerates .env, .git, backup archives, or administrative directories.
  • No logging in: Never interacts with authentication endpoints, session workflows, or user forms.
  • No mutating payloads: Never sends POST, PUT, PATCH, or DELETE requests to audited domains.

How Site Owners Can Opt Out

Site owners and infrastructure operators have two immediate mechanisms to prevent SurfaceScan from querying a domain:

Option A — Instant Self-Service DNS TXT Opt-Out

Publish a DNS TXT record at _surfacescan.<yourdomain> with the exact value optout. Before making any HTTP or TLS connection, SurfaceScan checks the queried hostname and walks up parent names (up to 4 lookups). When found, the scan is immediately refused. 

_surfacescan.example.com.   IN   TXT   "optout"

Option B — Permanent Blocklist Request

Prefer not to modify DNS records? Submit a removal request via our Contact Page (or email [email protected]) specifying the domain. Once verified, we add the domain to our persistent blocklist covering the apex domain and all subdomains.