Domains

Domains are the foundation of every security assessment in PreBreach. Before you can run a scan, you need to register and verify the web applications you own.

What is a Domain?

A domain in PreBreach represents a web application you want to test for security vulnerabilities. This is typically a root domain (e.g., example.com) or a subdomain (e.g., app.example.com) that hosts your application.

When you add a domain, PreBreach uses it as the entry point for all reconnaissance, scanning, and AI-driven analysis. The scanner will discover subdomains, crawl pages, and probe for vulnerabilities — all scoped to the domain you provide.

Why is Verification Required?

PreBreach is a powerful offensive security tool. To ensure it is used ethically and legally, we require DNS-based ownership verification before any scan can be initiated.

Verification serves three purposes:

1. Proof of ownership — Only the person who controls a domain's DNS records can add the required TXT record. This confirms you have administrative authority over the target.
2. Legal compliance — Scanning a web application without authorization is illegal in most jurisdictions. Verification acts as an implicit authorization step.
3. Abuse prevention — Requiring verification prevents bad actors from using PreBreach to attack domains they do not own.

You will not be able to start a scan on any domain until verification is complete. For a step-by-step guide, see DNS Verification.

Domain Limits by Plan

The number of domains you can register depends on your subscription plan:

If you reach your plan's domain limit, you can either remove an existing domain or upgrade your plan to add more.

Supported Domain Formats

PreBreach accepts the following domain formats when adding a new target:

Do not include the protocol (https://), port numbers, or URL paths when adding a domain. Enter only the hostname.

Managing Your Domains

You can manage all your domains from the Domains page in the PreBreach dashboard. From there you can:

• Add a new domain — Register a domain and begin the verification process.
• View verification status — See which domains are verified and ready to scan, and which are still pending.
• Remove a domain — Delete a domain you no longer need to scan. This will also remove all associated scan history and reports.
• Re-verify a domain — If verification previously failed, you can retry after correcting your DNS configuration.

Domain States

Each domain has one of the following statuses:

Removing a Domain

When you remove a domain from PreBreach, the following data is permanently deleted:

• The domain record and its verification status.
• All scan history associated with the domain.
• All generated reports (PDF, HTML, and JSON).
• All vulnerability findings and evidence.

This action cannot be undone. If you need to retain reports, download them before removing the domain.

Frequently Asked Questions

Can I scan a domain I do not own? No. PreBreach requires DNS verification to confirm ownership. You must have administrative access to the domain's DNS records.

What happens if I remove the TXT record after verification? Your domain will remain verified. The TXT record is only checked during the verification step. However, we recommend keeping it in place for future re-verification.

Can I transfer a domain to another PreBreach account? Not directly. Remove the domain from the original account and add it to the new account. The new account owner will need to complete DNS verification.

Do subdomains count toward my domain limit? Yes. Each entry in your domain list counts as one domain, whether it is a root domain or a subdomain.

Next Steps

• Set up DNS verification to verify your first domain.
• Start a scan once your domain is verified.
• Understand scan phases to know what happens during a security assessment.