Abuse desk
If our traffic reached your systems and you want to understand it, or want it to stop, this page tells you who we are, how to recognise us, and how to reach a person. There is always someone to write to.
Who we are
Paragon DNS is an external security-posture monitoring service operated by Paragon DNS. We check domains our customers ask us to monitor - their own domains, or domains they are responsible for - for DNS, email-authentication, TLS and web-exposure problems, and we report what we find to that customer. We are not a marketing scanner, we do not sell what we observe, and we do not run broad internet-wide sweeps.
The address our checks come from
Our checks identify themselves in your logs. Requests carry a User-Agent that names the tool and links back to this site, so you can tell our traffic from anyone else's:
The source address can change as our infrastructure moves and is refreshed here daily; the User-Agent is the stable way to identify us. When a check runs for one of our customers the User-Agent also says whom it runs for, as customer.domainaudit.
What we do, and what we do not do
What we do
- Resolve DNS and read published records (SPF, DKIM, DMARC, MX, CAA, DNSSEC).
- Fetch the home page over HTTPS and HTTP to check it is reachable and unchanged.
- Read public certificate-transparency logs and public reputation feeds.
- Check whether well-known ports answer, at a light rate, on domains we monitor.
What we do not do
- We do not attempt to log in, guess credentials, or exploit anything.
- We do not run intrusive or high-rate probes without the domain owner first proving control of the domain.
- We do not send mail to your users, and we do not scan third parties on a whim.
- We do not scan a domain that no customer of ours has added, except a single free check a visitor runs against a domain themselves.
Allowing our checks through
If you want our checks to reach you even when a shared blocklist carries our address, allow us by what we send rather than by where it comes from:
- Web servers and firewalls: allow requests whose User-Agent contains DomainAudit/. That is every HTTP check we run.
- Ports: our service inventory opens a TCP connection to a fixed list of well-known ports and reads what answers. It never sends exploit traffic, and a domain whose ownership has not been verified to us sees only its own web and mail ports.
- Mail: our spoof test deliberately sends one message as your own domain, straight from the address above, to see whether your gateway refuses it. If your gateway refuses the address for its reputation rather than for your policy, the test says so; allow the address on the gateway and run it again. Everything else we send, alerts and reports, comes through Amazon's mail relay, not from that address.
- DNS: our lookups go to public resolvers and to your authoritative servers as any resolver would; nothing needs allowing.
Ask us to stop
If you do not want us to check a domain you control, email us and say so. Tell us the domain and, if you can, confirm you are responsible for it. We will confirm receipt, stop checking that domain, and add it to our do-not-scan list.
A do-not-scan request is honoured for the domain as a whole. If one of our customers has legitimately added a domain that is genuinely theirs, we may need to confirm the conflicting claims with both parties before we act - but the checks stop while we do.
Our do-not-scan promise
Once a domain is on our do-not-scan list we do not check it again - not on a schedule, not from a customer adding it, and not from the free public check. The list outlives any single request. We would rather miss a domain we were entitled to look at than keep touching one whose owner asked us not to.