Scope and ownership verification

What Spectra examines, and how far it connects.

What is evaluated

Spectra examines certificates, DNS and other public observations available to an attacker. It does not replace internal penetration testing or authenticated application testing; those belong to specialised services.

Every plan, including Free, evaluates the same checks. The full list and criteria are on the checks page once you sign in.

Ownership verification

Owning a domain name and owning the server it points to are different things. A scanner that does not tell them apart can be turned against third parties. So active checks wait for two confirmations.

Prove the name. You publish a TXT record with a token that is unique to your account. One person's proof never becomes another person's permission.
```
_posture-challenge  TXT  "posture-verification=…"
```
Prove the address. Either the reverse DNS of the address leads back under your domain, or the address itself serves the verification file. Until one of those holds, we do not connect.
If it cannot be confirmed, nothing happens. No packets are sent and no external index is queried. The decision is made right before connecting, so swapping the record after the check does not work either.

Remove the record and active checks stop from the next evaluation. Internal network addresses are refused the same way.

Scope and limits

Item	Limit	Why
Manual run of the same domain	4 hours after the last run; on Free, the plan interval	So that a target is not contacted repeatedly in short succession.
Manual runs per account	Once per hour across all domains	It is not built for sweeping through large numbers of domains.
Domains you can register	Set by plan	See Plans and limits.
Active checks	Only after confirmation	Both the name and the address are confirmed before anything runs.
What is examined	The outside only	Server configuration and source code are never read.