Black-Box Scans
A black-box scan assesses what your organization exposes to the internet without sending your application a single request. It is the other half of Codity Pentesting: an active test tells you whether your application can be attacked, a black-box scan tells you what is visible and how it is configured.
Because it never contacts your application, it cannot affect performance, trip a rate limiter, or appear in your access logs. That makes it safe to run against production at any time, with no coordination, and safe to run against infrastructure you do not host yourself.
Running one
- Add a domain and verify it — see Domain Verification.
- On the Domains tab, select the run button on the verified domain.
- Follow it on the Reports tab. A black-box scan finishes in minutes.
There is nothing else to configure: no target URL, no credentials, no mode. A black-box scan is bought per run like any other assessment, and the price is shown before you confirm.
Where the information comes from
Everything in the report is drawn from data already published about your organization:
- Certificate transparency records — the public log of certificates issued for your domain, which is how hostnames you have forgotten about resurface.
- Public DNS — your A, AAAA, CNAME, MX, NS, TXT, CAA, DMARC, MTA-STS and TLS reporting records.
- Public network registration data — who owns the address ranges your names resolve to.
What it reports
- Hostnames and subdomains associated with your domain, including ones you may have forgotten about
- The public IP addresses your names resolve to
- Your mail and name server configuration
- Email spoofing protection — SPF, DMARC and DKIM — with a letter grade
- Certificate authority authorization (CAA), MTA-STS and TLS reporting policy
- The hosting and infrastructure providers your footprint sits on, with the evidence behind each conclusion
- The network registration records behind your addresses
- A categorized inventory of your public attack surface
The findings it raises
Black-box findings are posture findings. They sit at medium and below, because none of them is an exploitable flaw in your application — they are ways your domain can be abused or misrepresented.
| Finding | Severity |
|---|---|
| SPF record is missing | Medium |
| DMARC record is missing | Medium |
| No DKIM key observed among the common selectors | Medium |
DMARC is published but set to monitoring only (p=none) |
Low |
| A subdomain points at a CNAME target that no longer resolves | Info |
On DKIM
DKIM selectors are arbitrary names chosen by whoever set up your mail, and there is no way to enumerate them. Codity tests the 27 selectors that common mail providers use. A domain signing under a custom selector is reported as not observed, never as absent — the finding says so explicitly and asks you to confirm with your mail administrator.
On unavailable data
When a public data source cannot be reached, the affected result is reported as
unknown, the email grade becomes N/A, and the report carries a warning saying
the picture is incomplete. A failed lookup never turns into a missing-SPF,
missing-DMARC or missing-DKIM finding.
When to use it
- On production, at any time, with no coordination needed
- On systems you do not host yourself and are not permitted to actively test
- As the first assessment on a new domain, before you commit to an active test
- On a schedule, to catch the classic quiet problems: a forgotten staging subdomain still resolving, a DMARC policy left in monitoring mode, a domain with no anti-spoofing protection at all
What it cannot tell you
A black-box scan proves nothing about your application's behavior. It will not find a SQL injection, a broken access control or a cross-site scripting flaw, because it never interacts with the application. Use it to understand exposure, and an active test to understand exploitability. Most teams run both against the same domain.
