Third-party domains in server settings: updated rules

We have added a section on third-party domains to our Terms of Service. The key point first: you still decide which software and protocols run on your server. The rule is only about whose resource is set as the target of a connection, and it applies to personal use too.

What your settings must contain

Every setting that defines the target of a connection must point to your own resource: your domain and your web server, usually on the same server. A third-party domain or IP address is not allowed there. This covers:

• SNI and serverName;
• dest, target and fallback;
• handshake domain;
• the TLS certificate;
• any other setting serving the same purpose.

It is a violation even when the third-party site has nothing to do with your server and its name is only there to make the connection look like a visit to it — for example, the domain of a large internet service set as the target.

Strictly unacceptable

Presenting a server as a resource of a bank or payment system, a government body, a telecom operator or internet provider, or critical infrastructure. More than an address is at stake here: such impersonation creates legal risks for both you and us.

Why

Impersonating other websites is a common reason addresses get blocked. A blocked address drops out of the pool, leaving fewer clean addresses for new servers. We check our addresses every day and do not hand out blocked ones; the new rule keeps their number from growing.

How we find violations

• Automatically: every 3 hours we check which TLS certificate a server presents on public ports.
• Through abuse reports sent to us.

Two weeks to put things right

Until 23:59 UTC on 15 October 2026, the rule works in warning mode. If the check finds a third-party domain, support opens a request and you have three days to fix the settings. Once fixed, the matter closes by itself — no need to write to us. If the violation is still there after three days, the service is blocked.

From 16 October there will be no more warnings: a violation means the service is blocked straight away.

A block is final: the service is not restored afterwards, and there is no refund for the paid period. The server is shut down and its data is not destroyed at that moment, but it cannot be brought back into service. There is no second chance, so check your servers now, while any mistake can still be fixed at no cost.

Check your own server

Look up its IP on platform.censys.io to see which certificates its open ports present. Or ask the server directly: openssl s_client -connect IP:443 </dev/null | openssl x509 -noout -subject should show your own domain.

Updated terms

The rule is in the Third-Party Domains section of our Terms of Service. The next time you sign in to your account, you will be asked to accept the updated terms.