Domains

Use Settings -> Domains to manage external domain scope.

Whitelist

The whitelist is the allow-list for external discovery and assessment. Add domains that are approved for testing.

Examples:

example.com
*.example.com
*.dev.example.com

Use the whitelist to keep discovered related domains inside approved scope.

Domain scope controls which domains are allowed. Domain ownership verification is handled separately in Settings -> Domain Verification.

Domain Verification

Blacklist

The blacklist blocks domains even if they would otherwise be included by discovery or whitelist rules.

Examples:

analytics.example.com
*.third-party.example
payments-vendor.com

Use the blacklist for:

• third-party services;

• production areas excluded from the engagement;

• domains owned by partners or vendors;

• targets that must not receive automated traffic.

Rule Precedence

Blacklist takes precedence over whitelist.

If *.example.com is whitelisted and billing.example.com is blacklisted, billing.example.com is excluded.

Before a Scan

Confirm:

• every intended root domain is listed;

• excluded third-party domains are blacklisted;

• wildcard rules do not accidentally include unrelated assets;

• scheduled scans still match the current domain policy.