See your organisation the way an attacker does.

No. Perimeter runs passive checks only: DNS lookups, a TLS handshake with your public hostnames, an HTTP GET of your home page, and lookups in public certificate transparency logs and third-party datasets. It never port-scans, never attempts to exploit anything and never tests credentials. This applies to every domain, verified or not.

The full list of what we do and do not do is in the scanner policy.

When you add a domain, Perimeter gives you a unique token. Publish it as a TXT record at _perimeter.yourdomain.com with the value perimeter-verify=<token> and click verify. The record can stay in place; we re-check it periodically.

Unverified domains get the passive scorecard at monthly cadence and nothing else. Verification unlocks the full check set, your plan's scan cadence, alerts and the public scorecard link. This is deliberate: it stops Perimeter being used to watch domains you do not control.

Each category is scored from 0 to 100 based on weighted findings, and the overall score is a weighted combination of the categories. Letter grades map onto the overall score: A is 90 and above, B 80–89, C 70–79, D 60–69, F below 60. The weights are shown inside the app so you can see exactly why a finding cost what it did.

A score describes what is publicly observable about your external configuration. It is not a statement about your internal controls, your people or your incident history, and an A is not a guarantee that you cannot be breached.

Every finding shows the raw evidence we captured (the DNS answer, the headers, the certificate). If you believe it is wrong, use the dispute button on the finding; it sends the evidence to our team and we reply by email. If it is a false positive we fix the check, not just your result. You can also mark a finding as accepted risk or false positive yourself; it is then excluded from your score and logged.

For a public scorecard of a domain you own but have not claimed, email abuse@cod3lab.com with the domain and the finding.

All checks come from two published IP addresses, 3.70.94.251 and 18.157.173.40, with the user agent PerimeterScanner/0.1 (+https://perimeter.cod3lab.com/scanner). You can allowlist them, rate-limit them or block them; blocking will simply make the affected checks report as unreachable. Details are in the scanner policy.

You can add any domain and see its passive scorecard, which is the same information anyone with a terminal could gather in a few minutes. Free scans are rate-limited per account and per IP address, and only the verified owner can unlock more frequent scans, the remaining categories, alerts and the detailed evidence. If you are an MSP or broker acting for a client, ask them to publish the verification record; it takes two minutes.