SecurityScorecard uses RDAP (Registration Data Access Protocol) registration records to attribute domains to your scorecard. This article explains how domain attribution works with RDAP, what the registration data contributes, and how to review the domains on your scorecard.
How domain attribution works
Domain attribution determines which domains belong to your organization's Digital Footprint. A domain is attributed to a scorecard when it shares at least one of the following with the scorecard's known assets:
- A nameserver
- The apex domain of the registrant email
- The organization name
Each of these values comes from the domain's registration record. SecurityScorecard retrieves that record using RDAP.
Learn what RDAP provides
RDAP is the standard protocol for looking up who registered a domain or IP block. It is the authoritative source of registration data for gTLDs. RDAP works as follows:
- It returns registration data as structured JSON over HTTPS, so the response is encrypted and machine-readable.
- It uses one standardized schema for domains, IP addresses, and ASNs across all registries. Nameservers, registrant details, and organization names appear in the same fields for every source.
- It routes each query to the authoritative server automatically through the IANA bootstrap registry.
- It supports tiered access and standardized redaction, so registries can limit which registrant details are publicly visible.
See how RDAP data drives attribution
SecurityScorecard reads the nameservers, registrant email, and organization name from a domain's RDAP record and compares them with the known assets on your scorecard. A match on any one of the three attributes links the domain to your Digital Footprint.
Because the record is structured, each value is read from a consistent field instead of being extracted from free-form text. This keeps domain quality high. Domains whose registration data is older than 45 days, or that change so there is no longer a registrant name, email, or name server match, fall off your Digital Footprint.
A domain's attribution depends on what its RDAP record publicly shows. If a registry redacts a field, that field is not available as a matching signal for the domain. When registration data changes, domains can be added to or removed from your Digital Footprint, and your score can shift.
Understand what RDAP does not change
RDAP is the source of registration data only. It does not change the attribution logic or the scoring methodology. A domain still has to share a nameserver, the apex domain of the registrant email, or the organization name with your known assets.
Review a domain on your scorecard
If a domain looks incorrectly attributed or removed, review it as follows:
- Look up the domain's public RDAP registration record.
- Compare the nameserver, the apex domain of the registrant email, and the organization name in the record with your known assets.
- Consider making changes, or having your domain registration vendor make changes to the Registration data in a way that reflects your desired domain attribution
- If you still believe the domain is incorrectly included or removed, submit it for review. For steps, see Manage and validate your Digital Footprint.
The SecurityScorecard team reviews each submission.
Additional resources
For more information on RDAP, see the following external resources:
ICANN RDAP overview: https://www.icann.org/rdap
IETF RFC 9082 (query format): https://www.rfc-editor.org/rfc/rfc9082
IETF RFC 9083 (JSON responses): https://www.rfc-editor.org/rfc/rfc9083
IANA RDAP bootstrap registry: https://data.iana.org/rdap/dns.json