Adding a domain starts nothing by itself. The domain’s page then offers two steps: a quick check of the public settings, when you choose to run it, and the ownership proof that unlocks the full audit, the history and the alerts.

Add the domain

Choose Add a domain, from the domain list or from the menu.
Enter the registrable domain: example.com, not www.example.com or shop.example.com. Subdomains are discovered automatically from public sources such as certificate logs.
On the Agency plans, pick the client the domain belongs to, or leave it under the workspace itself.
Press Add domain. You land on the domain’s page, with its status pending.

Only owners and admins of a workspace can add domains.

The quick check (step 1 of 2)

Run the quick check gives a first look at the domain with the public checks only: e-mail authentication, DNS, certificates, mail servers and websites. It takes about two minutes and attacks nothing. The progress bar shows each step, and the report appears on the page by itself.

Because nobody has proved yet that the domain is yours, the quick check is a preview:

the public settings (SPF, DMARC, DNSSEC, CAA, certificates and the like) are shown in full, with their fix;
findings whose details could help an attacker, such as a subdomain that could be taken over or an exposed service, are named by family only. Their details come with the proof;
sensitive files are not probed, and what public archives, other certificates bearing your brand and breach data say about the domain waits for the proof;
the result is labelled “public preview” in the domain list and in the history.

A quick check can run once an hour per domain. If you would rather go straight to the full audit, open Skip it and prove ownership now.

Then prove ownership (step 2 of 2)

The full audit starts once the domain is proved with a TXT record. See Prove that a domain is yours with a TXT record.

Limits on adding domains

Domains in a workspace: 1 on Free, 5 on Solo, 25 on Agency, 100 on Agency Plus. A paused domain still takes its place when you add a new one: remove it to free the place.
Domains waiting for their proof: one at a time on Free and Solo, three on Agency and five on Agency Plus. Prove (or remove) a waiting domain before adding the next one, so unproved domains do not pile up.
Additions per 24 hours: 3 on Free, 10 on Solo, 50 on Agency and 150 on Agency Plus.

Have many domains to add? Import a list of domains instead: imported domains wait for their proof without counting in the one-at-a-time limit.