What the assessment covers
A domain's external footprint includes more than its homepage. Public DNS records, certificate-related information, HTTP responses, TLS metadata, and security headers can provide useful evidence about how an internet- facing domain is configured.
CyberSurfaceMap uses four scanner families: domain resolution, DNS intelligence, passive subdomain discovery, and HTTP/HTTPS intelligence. Their results are collected and normalized into findings before the risk assessment is calculated.
An observed record or exposed service is not automatically a vulnerability. Findings need context and, where appropriate, independent verification.
Domain resolution
The domain scanner queries DNS for IPv4 address records (A) and IPv6 address records (AAAA). It collects the resolved addresses and validates them through the application's server-side request forgery (SSRF) protection service.
Resolution helps connect a domain name with public addresses. Results can vary with DNS configuration, resolver behavior, and changes to records over time.
DNS intelligence
The DNS intelligence scanner collects available records of these types:
- A and AAAA: IPv4 and IPv6 addresses.
- CNAME: canonical name aliases.
- MX: mail exchanger information.
- NS and SOA: delegation and zone data.
- TXT: published text records, including records that may contain email policies.
- CAA: certificate authority authorization records.
- DS and DNSKEY: DNSSEC-related records that are publicly observable.
The scanner also extracts SPF records from TXT results, queries the domain's DMARC record, performs reverse DNS lookups for resolved addresses, detects wildcard DNS, and provides a summary of observed record types and addresses.
Observing DS or DNSKEY records is not, by itself, a complete DNSSEC validation. Likewise, finding an SPF or DMARC record does not establish that an organization's complete email-security configuration is correct.
Passive subdomain discovery
The subdomain intelligence scanner searches publicly available Certificate Transparency records and can use Cert Spotter as a fallback provider. It extracts and normalizes discovered names that belong to the requested domain.
This is passive discovery. The scanner does not resolve the discovered subdomains, connect to those hosts, send requests to them, perform port scans, or brute-force possible subdomain names.
A discovered name is a lead for asset inventory and authorized review; it is not proof that the host is currently online or vulnerable.
HTTP, HTTPS, TLS, and security headers
The HTTP intelligence scanner makes lightweight requests to the root path over HTTP and HTTPS. It collects response metadata such as status code, final URL, redirect count, content type, server header when supplied, and content length.
It passes the observed response headers to a security header analyzer. The results can include headers that are missing and headers with issues identified by that analyzer.
For HTTPS, the scanner also gathers TLS metadata, including the reported protocol version, cipher, verification result, and certificate information when available. Certificate data can include subject, issuer, validity dates, serial number, and subject alternative names.
These are low-impact observations of the root endpoint and TLS connection. They are not a comprehensive crawl of every page, API, or host associated with the domain.
How findings inform risk assessment
Scanner outputs are normalized into structured findings containing details such as a code, category, title, description, severity, scanner name, evidence, and metadata where available.
The risk assessment service evaluates persisted findings and stores a risk score, a risk level, and contributing factors. This gives users a structured way to review observed issues and decide what deserves investigation first.
A risk score is an assessment aid, not a guarantee that every security issue has been detected. The result depends on the checks that ran successfully and the evidence available during that scan. Review individual findings and evidence rather than relying on one number alone.
What the assessment does not do
CyberSurfaceMap's documented domain-scanning workflow does not perform exploitation, authenticated testing, form submission, website crawling, port scanning, or brute-force subdomain enumeration. Passive subdomain discovery does not actively connect to discovered hosts.
Consequently, a scan is not a penetration test, a full vulnerability audit, a compliance certification, or a guarantee that a domain is secure. Unobserved assets, application logic flaws, access-controlled resources, and issues requiring deeper testing may not appear in the results.
How to use the results
- Assess only domains that you own or are authorized to review.
- Check which scanners completed and review any scan errors.
- Examine each finding's evidence, severity, and description.
- Verify important findings using an appropriate, authorized method before making changes.
- Prioritize remediation based on context, potential impact, and the systems affected.
- Repeat the assessment after changes and compare the available evidence.
For foundational concepts, continue with the external attack surface guide, the domains, subdomains, DNS, and IP addresses guide, and the passive subdomain discovery guide.
Use the main platform to begin an assessment of a domain you are authorized to review.
