Architecture & Roadmap
Live DNS propagation, attack surface detection pipeline, and zero-trust security specifications.
DNS Authentication & Mail Routing Specification
System Architecture Specification
Passive discovery (AlienVault, HackerTarget, crt.sh) executes concurrently with active permutation resolvers under bounded concurrency (asyncio.Semaphore). Wildcard DNS is suppressed by probing non-existent 32-character UUID hostnames to filter sinkhole responses. Outbound HTTP/DNS requests enforce fail-closed network boundary isolation:
pinned_get Transport: Mitigates DNS rebinding TOCTOU attacks via single-resolution IP pinning. Hostname is resolved once; all returned A/AAAA addresses are validated; socket connects directly to validated IP while preserving Host header, TLS SNI, and cert verification. Redirects re-resolve and re-validate every intermediate hop.Canonical Blocklist: Fail-closed dual-stack rejection of RFC 1918, RFC 4193 (ULA), Carrier-grade NAT (100.64.0.0/10), loopback, link-local, and Cloud Metadata (AWS IMDSv1/v2 169.254.169.254, GCP, Azure, and IMDSv6 fd00:ec2::254/128).Evaluates dangling CNAME chains against 20 verified cloud provider error fingerprints (AWS S3 NoSuchBucket, GitHub Pages 404, Vercel, Fastly) with response body regex matching before incident creation.
Automated TLS expiration alerts at 30/14/7-day thresholds, RFC 7208 lookup counter (10-query ceiling), and 3-tier staging exposure detection across naming heuristics, basic auth probes, and robots.txt.
Scan runs commit atomically via PostgreSQL RPC. State-transition eventing suppresses repeat alerts for persistent incidents across subsequent scans:
2-Clean-Scan Hysteresis: Incidents resolve only after 2 consecutive scans with status COMPLETE. If an open incident is re-observed, its clean observation counter resets immediately to 0. Partial scans, timeouts, or resolver drops never increment the counter or trigger resolution.Transactional Outbox & Channel State: Queue worker claims batches using PostgreSQL FOR UPDATE SKIP LOCKED with lease expiry recovery and a 5-attempt budget. Per-channel delivery state is tracked in a normalized child ledger (outbox_deliveries). Failed attempts retry only incomplete destinations; the parent event completes only when all destinations succeed. Deliveries are at-least-once: deterministic event-scoped keys (outbox_{event_id}_{email}) eliminate duplicate Resend dispatches where the provider honors idempotency; Slack does not deduplicate inbound webhooks. Exponential backoff (60s to 3600s cap) and terminal DEAD_LETTER status bound retry overhead for individual poison events.Pre-deployment security gate implemented as a specialized Go binary (subdomainwatch-guard) for CI/CD Pull Request pipelines:
tfplan.json) or workspace HCL offline. When a declared CNAME points to a known cloud provider signature, the guard executes bounded HTTP fingerprint probes (3s client timeout, 2s dial and TLS-handshake timeouts, 16 KiB Range header and response limit, environment proxy disabled) through an IP-pinning dialer enforcing canonical SSRF blocklists. Probes include wildcard-baseline suppression and fallback canonical target checks.upload-sarif) and enforces in-code override line-proximity rules (# subdomainwatch:ignore). Central dashboard telemetry sync is strictly opt-in via API key.