Start with the live form
Enter a domain, URL, IP, email, or record and get a focused result without setup.
All tools
Web Data
Domain Intelligence
DNS & Infrastructure
Security & Trust
Identity & Verification
Monitoring & Automation
security.txt checker
Enter a domain to fetch its security.txt, read the vulnerability disclosure contacts and confirm the file is valid and not expired.
Results
Interactive intelligence tool
Run the check, then ship the workflow
Use the browser tool for a fast answer, then move the same logic into scripts, monitoring, or product flows when it becomes repeatable.
Review decision-ready signals
Outputs highlight statuses, risks, records, and next actions instead of raw provider noise.
Automate the workflow that works
Use the request and response examples to turn a one-off check into an API call or recipe.
Used by people at these companies
What this tool helps you decide
Each page is shaped around a practical operational question, not just a raw lookup.
See the current DNS, registration, security, pricing, or reputation evidence.
Compare the result with related checks so the next move is easier to trust.
Copy examples, open linked tools, or move into API documentation when you need scale.
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
Service status
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
Free allowance
Sign up for free
Start with 10,000 monthly credits and upgrade only when usage grows.
Active
Example request
Start from the curl and HTTP samples, then map the parameters into your application code.
Key Features
Both locations
Reads /.well-known/security.txt and only falls back to the legacy /security.txt when the first returns 404 or 410.
Field validation
Checks Contact, Expires, Encryption, Policy, Canonical, Preferred-Languages and other fields, with errors and warnings kept apart.
Expiry tracking
Shows when the file expires and how many days remain, and flags expired or overly long expiry dates.
Example request
GET /v1/security-txt?domain=example.comBuilt on the same API
The browser experience previews DomScan's structured endpoints, so teams can validate a use case before writing code.
Frequently asked questions
What is security.txt?
A plain text file defined by RFC 9116 that tells security researchers how to report vulnerabilities to an organization.
Which fields are required?
At least one Contact field and exactly one Expires field. Expires must be a future date, and RFC 9116 recommends less than a year ahead.
Is the PGP signature verified?
Signed files are detected and parsed, but the signature itself is not verified.