Domain Security Check terms of service
Version 1 · Last updated: 2026-11-08
These terms apply when you order Domain Security Check from Rotomal. They sit alongside our general terms, privacy policy and refund policy; where they differ, these product terms apply to Domain Security Check.
Who provides the service
Domain Security Check is provided by Rotomal, Israel ("we"). Contact: hello@rotomal.com.
The service
A one-time, outside-in security check of one registered domain and the subdomains we find for it: registration, DNS, email authentication, certificates, web security headers and exposed services. You receive a report and a fix brief by email.
What is included
- One registered domain and every subdomain we find for it.
- Ownership verification by DNS TXT record or by a file on your website, before any test runs.
- Registration, DNS, DNSSEC and CAA checks; SPF, DKIM, DMARC, MTA-STS and mail server TLS.
- Certificates, HTTPS, HSTS and web security headers; subdomain takeover risks, common open ports and publicly reachable files.
- Blocklist check and a list of registered lookalike domains.
- Report by email within 24 hours of verification, with a fix brief as PDF, Markdown and JSON.
- A full refund if ownership cannot be verified or the report is not delivered within 24 hours of verification.
Plans and prices
| Plan | Price | Covers |
|---|---|---|
| Domain security check | $10 one-time per domain | One domain and every subdomain we find for it |
$10 once per domain, including the subdomains we find for it. No subscription. Ownership must be verified before the check runs; if it can't be verified, or the report isn't delivered within 24 hours of verification, you are refunded in full. Founding customer price for early-access orders.
Prices are founding-customer prices for early-access orders. Taxes are added where the law requires.
Limits and extra use
One purchase covers one registered domain (for example example.com) and every subdomain we find for it, checked once. A second registered domain, such as example.co.uk, is a separate $10 check. Anything beyond this scope is quoted by email before we start and is never charged without your written OK.
How an order starts
Submitting a request does not create a contract or a charge. A contract starts only when we confirm your order by email and payment has been agreed. We start within 2 business days of that confirmation.
Billing, cancellation and refunds
This is a one-time service, paid once after we confirm the scope by email. There is no subscription and nothing renews. If we cannot deliver what was agreed, you are refunded in full.
Refunds and cancellations also follow our refund policy. rotomal.com/refund-policy/
What is not included
- This is not a penetration test: we do not test your application's logic, guess passwords, run exploits or load tests, or send mail to your users.
- We do not certify compliance with ISO 27001, SOC 2, PCI DSS, GDPR or any other standard, and the report is not legal or compliance advice.
- We do not apply fixes. You, your IT person or your AI agent apply them.
- We never ask for registrar, DNS, hosting or email passwords, and we do not read your data or mailboxes.
- We do not test any domain whose ownership has not been verified, or anything outside the verified domain and its subdomains.
Your responsibilities
- Request checks only for domains you own or control, or for which you hold the owner's written authorization.
- Give the correct domain and an email address you control for the report.
- Add the verification code exactly as sent and keep it in place until the check has run.
- Review every fix before it goes live, including changes drafted by an AI agent, and do not give an agent your registrar or DNS password.
- Check the report before relying on it, and keep it confidential, since it describes weaknesses an attacker could use.
- Have the right to share any information you send us about the domain and its services.
- You use the service only for lawful purposes and keep your account details safe.
Regulatory status
This product includes security testing. Before any test, you confirm that you own the domain or have written authorization from its owner to test it and its subdomains, and we verify control of the domain by TXT record or file. Tests stay within that domain and are low-volume and non-destructive. We are not an accredited auditor or a penetration-testing firm, and the report is not a certification. Hosting providers, registrars and other services you use set their own rules and decide independently; their decisions are outside our control.
Outside services
- Your DNS host or web host: verification depends on the code being visible there. If publishing is slow, the 24 hours start only once we can see the code.
- Public registration data (RDAP and WHOIS), certificate transparency logs and DNS blocklists: if a source is incomplete or unavailable, findings in that area may be incomplete.
- Email delivery: the report goes only to the address on the request. Check spam folders if it does not arrive.
- AI agents such as Claude, ChatGPT, Copilot or Cursor: what they produce from the fix brief is their output, not ours, and must be reviewed before use.
The service relies on systems run by others. We are not responsible for their availability, changes or decisions; when one of them changes, we adapt the service as soon as we reasonably can.
Your data
Data and files you send stay yours. We process them only to provide Domain Security Check, as described in our privacy policy, keep them no longer than the service needs, and delete them on request when the service ends.
Early access and errors
Domain Security Check is an early-access service, provided as is and as available. We work carefully, but output can contain errors. If you show us an error in our output, we correct it and redo the affected work at no charge; this is your main remedy for errors.
No professional advice
Domain Security Check is a software and data service. It is not legal, tax, customs, accounting, insurance or other professional advice. Confirm decisions that depend on such advice with a qualified professional.
Liability
- Our total liability for all claims about Domain Security Check is limited to the fees you paid us for Domain Security Check in the 12 months before the claim.
- We are not liable for indirect or consequential loss, lost profit or revenue, or for fines, penalties, duties, taxes, surcharges, interest or chargebacks imposed on you by an authority, carrier, marketplace, bank or other third party, even where our output was used.
- Nothing in these terms limits liability that the law does not allow to be limited, including for fraud, intent or gross negligence, death or personal injury, or the mandatory rights of consumers.
Suspension and ending the service
We may suspend the service if it is used unlawfully or against these terms. We may also stop offering Domain Security Check; if we do, we give paying customers at least 30 days' notice by email and refund any prepaid period not used.
Changes to these terms
We may update these terms. For existing customers, changes take effect 30 days after we email them and never change a price we have already confirmed to you. The date at the top shows the current version.
Law and disputes
These terms are governed by the laws of the State of Israel, and disputes go to the competent courts in Israel. If you are a consumer, you keep the protection of the mandatory laws of the country where you live and may also bring a claim there.
Contact
Questions about these terms: hello@rotomal.com.