Opting out of scanning
If you own a domain or website and don't want OrbitalCyber's cloud scanners to scan it, you can opt out yourself, at any time, without contacting anyone. It takes one DNS record. [!TIP] The short version: add a DNS TXT record with the value orbitalcyber-optout to your domain. Our cloud scanners will then refuse to scan that domain and every host name under it. Who this is for You saw traffic from our scanners and want it to stop. Our cloud scanners only scan systems for customers who have confirmed they own them or are authorised to test them, but you can always opt out. You're an OrbitalCyber customer and a scan says a target was refused because "the owner … has opted out of scanning". That target's owner published this record. See If you're a customer. Opt out in four steps Sign in to wherever your domain's DNS is managed. This is usually your domain registrar, your DNS host or your CDN (for example Cloudflare, GoDaddy, Namecheap, Amazon Route 53, Azure DNS or Google Cloud DNS). If you're not sure, ask whoever manages your website or email. Add a new DNS record with these values: Field What to enter Type TXT Name (also called Host) @ for the domain itself, or _orbitalcyber if you'd rather keep it separate from your other TXT records. Both work the same way. Value (also called Content or Text) orbitalcyber-optout TTL Leave the default Save the record. Check that it's visible (see Check your record). Once it is, the opt-out is in effect. That's all. There's no form to fill in and nothing to send us. [!NOTE] Use the domain you own, such as example.com. A record there covers example.com and every host name under it: www.example.com, shop.example.com, mail.eu.example.com and so on. The same record in zone-file format If you manage DNS with zone files, add either of these lines (replace example.com with your domain): Check your record Run one of these from any computer (replace example.com with your domain). macOS or Linux: Windows (Command Prompt or PowerShell): You should see "orbitalcyber-optout" in the answer for whichever name you used. If you don't, the change hasn't reached DNS yet: wait a few minutes and try again. What the record covers Our cloud scanners look for the record on the host name being scanned and on each parent domain up to your registered domain. For a scan of www.shop.example.com, they check: Checked Also checked under _orbitalcyber. www.shop.example.com _orbitalcyber.www.shop.example.com shop.example.com _orbitalcyber.shop.example.com example.com _orbitalcyber.example.com A record on any of these opts the host out. So to opt out only part of your domain, put the record on that part (for example shop.example.com); to opt out everything, put it on example.com. Extra text is fine. The record only has to contain orbitalcyber-optout, for example "orbitalcyber-optout; contact=security@example.com". Upper or lower case doesn't matter. It doesn't affect anything else. TXT records like this are ignored by email, websites and other services. IP addresses Customers can also ask a cloud scanner to scan an IP address or a range of addresses instead of a host name. For each address (every address in a range, one by one), our scanners look up its reverse DNS name (its PTR record) and check that name and its parent domains in the same way. So if your server's address has a reverse DNS name in your domain (for example 203.0.113.10 → server1.example.com), the record on example.com covers the address too. [!WARNING] If an address has no reverse DNS name, or its reverse DNS name belongs to your hosting or cloud provider (for example a generic name like ec2-203-0-113-10.compute-1.amazonaws.com), a record on your own domain can't cover it. Ask your provider to set a reverse DNS name in your domain, or contact us (see Contact). When it takes effect The record is checked twice: when a customer requests a scan, and again on the scanner right before it scans. So the opt-out applies as soon as your DNS change is visible, including…
OrbitalCyber documentation