Responsible Scanning Policy

1. Our scanning philosophy

Custodis exists to help organizations understand their external attack surface without becoming part of the problem. Every check we run is non-intrusive. We do not exploit vulnerabilities, we do not attempt to bypass authentication, and we do not change anything on the systems we check. Some of our checks send messages a browser would not, such as a TLS handshake that offers only an outdated protocol version; section 3 lists every one, and a server that will not accept one simply refuses it. Our HTTP requests to the systems we check identify themselves; TLS handshakes, port checks and DNS lookups cannot carry an identifier (section 5). The opt-out record in section 6 stops every scan of the domain it is published on.

2. What we never do

We never attempt to exploit a vulnerability, even one we have detected. We never submit credentials, bypass login pages, or interact with authenticated areas of any application. We never write to forms, post comments, or modify any state on a target system. We never run brute-force password attempts, credential stuffing, or any other authentication-targeting activity. We never perform denial-of-service tests or any scan pattern designed to degrade availability. We read at most the first 4 KB of any web page we request, and never more than 64 KB of anything. If a check would require any of the above, we do not perform it.

3. Exactly what we check

Passive checks run on every domain a customer monitors — its own domains and the domains of suppliers it has added — and on the hostnames we find under them. We find hostnames in two ways, on every scan of a domain that has passive discovery switched on, as every domain does until the customer switches it off: the hostnames that public certificate transparency logs show under the domain, and a DNS lookup of each of these 30 common names under it: www, mail, smtp, imap, pop, webmail, api, app, admin, portal, dashboard, staging, dev, test, uat, qa, demo, blog, docs, status, support, help, cdn, static, assets, media, auth, sso, login, id. Every name that resolves is checked in the same way as a hostname from the logs, even if it has never had a public certificate. With passive discovery switched off, no new hostnames are looked for under the domain, and the ones already found go on being checked. The checks consist of DNS lookups (including SPF, DKIM, DMARC, MTA-STS, CAA and DNSSEC records), a search of public certificate transparency logs while passive discovery is on, six TLS connections to port 443, one HTTPS and one plain HTTP request for the home page, and — for a domain that publishes an MTA-STS policy — one request for that policy file.

Two of the six TLS connections are ordinary handshakes, like a browser's. Each of the other four sends only the opening message of a handshake, reads the server's reply and hangs up, so no key is exchanged and no session is set up. One offers TLS 1.0 and one TLS 1.1, to learn whether the server still accepts those versions. One offers TLS 1.2 with a broad list of cipher suites, strongest first, and reads the certificates the server sends back. The last offers TLS 1.2 with only deprecated cipher suites, to learn whether the server would accept one. These four are not what a current browser sends, since browsers no longer offer TLS 1.0, TLS 1.1 or deprecated cipher suites. Each is still a well-formed message that any TLS client may send, and a server that will not accept it simply refuses.

Active checks are TCP connection attempts to a fixed list of fifteen common service ports (web, remote administration and database ports), reading only the first bytes a service sends of its own accord; nothing is sent to the service. They run only on a domain whose owner has proven control of it by publishing a DNS TXT record at _custodis-challenge.<domain> and has then explicitly turned active checks on. They are never run on a supplier's domain, which our database will not allow to be enabled.

Lookalike domains are checked once a week, with DNS lookups only. The sweep covers each of a customer's own domains that has passive discovery switched on — including one whose ownership has not been verified yet — and never a supplier's domain or a domain the customer has removed. For each, it looks up in public DNS up to 300 names that resemble it, such as misspellings and the same name under other top-level domains. It makes no connection to the domain's own servers or to any lookalike.

4. How often, and how hard

Each monitored host is checked once a day, and a customer can request an additional re-scan. We never exceed 10 requests per second to any one host, and a full check of one host is a handful of connections — traffic equivalent to a few casual visitors.

5. Identifying our traffic

Every HTTP request we make carries the User-Agent custodis-observer/1.0 (+https://custodis.app/legal/responsible-scanning), which links to this page. TLS handshakes, port checks and DNS lookups are not HTTP and carry no User-Agent. Our scan traffic leaves our cloud provider from addresses that are not fixed, so we do not publish an IP allowlist and cannot be identified by source address; please use the User-Agent, or the opt-out below.

6. Opting out

To stop Custodis scanning a domain, publish a DNS TXT record named custodis-no-scan.<domain> with any value — for example custodis-no-scan.example.com TXT "no". We look for it before every scan, and while it is present nothing under that domain is scanned, for any customer. Delete the record and scanning resumes with the next daily scan.

The record is looked up at the exact name a customer registered. If you are monitored under a subdomain — say a supplier added shop.example.com — publish the record at that name too, or write to abuse@custodis.app and we will add your whole domain, with every subdomain under it, to our do-not-scan list.

7. Customer responsibilities

Customers may register domains they own or are authorized to assess, and may add the domains of organizations they have a genuine business relationship with — suppliers, vendors, partners — for passive monitoring only. They must not use Custodis to monitor organizations they have no relationship with, attempt to evade our rate limits, spoof verification records, or otherwise misrepresent ownership, and they are responsible for complying with the law that applies to them and to the domains they monitor. Misuse is grounds for immediate termination under our Terms of Service, and we will cooperate with law enforcement where required.

8. Reporting abuse or concerns

If you believe Custodis is scanning something it should not, write to abuse@custodis.app with the affected domain, hostname or IP address and a brief description. We acknowledge every report within one business day and act on confirmed reports within twenty-four hours, including pausing scans of the disputed domain while we investigate. If you have found a vulnerability in Custodis itself, please report it to security@custodis.app — we will not pursue legal action against good-faith research reported that way.

9. Changes to this policy

We may update this policy as our checks change. Material changes — anything that broadens what we check or alters the verification requirements — will be announced in-product and by email at least fourteen days before they take effect. Editorial revisions are published immediately and noted in the LAST UPDATED date above.