Public footprint (mlab.sh)
See the third parties visible from a provider's public domain - mail and SaaS services, hosting, DNS, certificates and what its website loads - with an mlab.sh domain scan.
The Public footprint tab of a provider (/tp/detail/...) scans the provider's
domain with mlab.sh and lists the third parties visible from
outside, with a link when they are already in your register.
A preview of what is public, not the provider's subcontracting chain. The scan reads the provider's own corporate IT (mail, DNS, website), not necessarily what runs the service you buy, and misses everything that is not public. Confirm any subcontractor with the provider before you record it in the supply chain (B_05.02). It is not recommended for large providers (cloud, telecoms, major software vendors): their footprint spans thousands of services and says nothing useful about your contract. The tab warns when the provider is a designated CTPP.
What it finds
| Seen in | Examples |
|---|---|
| Mail / DNS | Microsoft 365, Google Workspace, SendGrid, Marketo, Atlassian, from MX, SPF and verification records |
| Name servers | Amazon Route 53, Cloudflare, Azure DNS |
| Hosting | CloudFront, Cloudflare, Fastly, Azure, and the hosting company of each address |
| Certificates | The certificate authorities that issued the domain's certificates |
| Registrar | The company the domain is registered with |
| Website | Technologies announced by the web server, and every external domain the home page loads (analytics, fonts, tag managers, consent tools) |
When the domain does not answer (name servers silent from outside, a website that refuses automated visits), the tab says what could not be seen rather than showing an empty list.
Set the mlab.sh API key
The scan runs on your mlab.sh account. As an administrator, paste an API key from
mlab.sh in Organization > General > mlab.sh API key (/orga/team/settings).
The key is never shown again once saved; Test key asks mlab.sh whether it is
valid and how many domain scans are left.
For a whole instance, set the key in .env instead; an organisation's own key
takes precedence:
MLAB_API_KEY=mlab_...
# MLAB_API_URL=https://mlab.sh/api/v1Your quota is spared
- Manual only. A scan runs when someone clicks Scan domain. Nothing scans on a schedule, and opening the tab never starts one.
- Recent scans are reused. If the same domain was scanned less than 7 days ago, for this provider or by anyone on mlab.sh, the existing result is used. Rescan forces a new one, after confirmation.
- Cost. A new scan uses up to 2 domain scans of your mlab.sh quota: one for DNS, hosting and certificates, one to load the website. With a single scan left, only the first runs.
- Before you click, the tab shows the quota left, and says so when the key is missing or invalid or the quota is empty.
A scan takes a few minutes; the tab follows it and shows the result when it is done.
Data and privacy
The scan sends the provider's domain name to mlab.sh, and nothing else from your register. The result is stored in your database.