SecuremarkBot

If you've seen this user-agent in your logs, a Securemark user has added a badge for your domain, or you have.

SecuremarkBot/0.1 (+https://www.securemark.dev/bot)

What it does

• One HTTPS GET to https://your-domain/ to read response headers (redirects followed, short timeout).
• One TLS handshake to read the certificate's validity, expiry and protocol.
• DNS-over-HTTPS lookups for SPF, DMARC, CAA and AAAA records, and DNSSEC status. These go to public resolvers, not to your server.

That's it: no crawling, no form submission, no vulnerability probing. Active scans (for example OWASP ZAP baseline) only ever run against domains whose owner has verified control with a DNS TXT record and explicitly opted in.

How often

At most once a day per domain on the free plan, and at most hourly for Pro projects. Scans run from GitHub Actions runners, so source IPs vary and are not a reliable allow-list.

Safety

The scanner refuses private, loopback and link-local addresses (SSRF protection) and never sends credentials or cookies.

Opting out

Email [email protected] from an address at the domain, or tell us which domain and we'll verify it with a DNS TXT record. We'll stop scanning it and remove its stored results. You can also block the user-agent, in which case its badges show an error state.