Which addresses on your domain are controlled by other companies?

This check lists addresses on your domain that point to a service run by another company, such as a help desk, status page or shop. Whoever manages that service decides what appears at your address.

What does this check look at?

It looks at whether an address on your domain points to a service run by another company. Addresses come from public certificate logs and DNS, and nothing is contacted. Reading DNS records, certificate logs and domain registration never touches your site.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site. It applies only when public certificate history for the domain could be read.

What does a result mean?

Pointing elsewhere is normal for many services, so it does not show anything is wrong, only who controls that address. When you stop using the service but leave the pointer, the address still points there. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Fix this soon. A finding of this kind needs a victim or a second step before it causes harm, so it ranks below anything someone could use directly. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

This is a short review, and an AI with read access to your DNS can draft it.

Here are subdomains of my domain that point to other companies: [paste the list from the report]. For each one, tell me which service it points to, whether I still use it, and who on my team manages it. For any I no longer use, give me the exact DNS record to delete. Do not delete anything yourself.

How to check

Say Atlas, our example app at atlas.example, points its help address at a support desk provider. The check lists it so the team can confirm the account is still theirs.

Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.