NAVIMASKDomainGuard
Sign in

The DomainGuard scanner

If you got here from the reverse DNS of an IP that queried your DNS servers, it is the Navimask DomainGuard scanner. It reviews a domain's public email and DNS security configuration when someone requests an audit or when a customer monitors it.

What we query

  • The domain's public DNS records: SPF, DMARC, DKIM (a fixed list of selectors), BIMI, MTA-STS, TLS-RPT, DNSSEC (DS and DNSKEY) and CAA.
  • The name servers and a few fixed names (www, mail and autodiscover), to detect delegations or aliases pointing to places that no longer exist.
  • One zone transfer attempt (AXFR) against the domain's authoritative servers. If it is refused, which is correct, we only record the refusal; if it is allowed, we do not keep the records.

What we do not do

  • We do not scan ports or make web, mail (SMTP) or any other service requests.
  • We do not try to access or change anything. The queries are the same any mail server or browser makes.
  • We do not enumerate subdomains or follow chains of names.

How often

  • When someone requests an audit. A domain's result is reused for 24 hours, so repeating it does not cause new queries.
  • Once a day for domains our customers monitor.
  • Forced re-checks of the same domain are at least 5 minutes apart.
  • Never more than 6 zone transfer attempts per minute against the same authoritative server.

How to identify us

Queries come from IPs whose reverse DNS is scanner.domainguard.navimask.com (or scanner-acc.domainguard.navimask.com in our test environment). Use that name to recognise them if you want to allow or block them in your firewall.

Exclusions and reports

If you do not want us to audit your domain or query your servers, or you think the scanner is causing you a problem, write to requests@domainguard.navimask.com with the domain or your servers' IPs. We answer on working days and apply exclusions as soon as possible.