Published 2026-04-28 — v1.0

Opt out

Two independent mechanisms to remove an organisation's domains from CipherCue's observation cycle. Either is sufficient on its own.

Option 1 — DNS TXT record (preferred)

Publish a TXT record at the apex of each domain you want excluded:

@ 300 IN TXT "ciphercue-optout=true"

CipherCue honours this record within 7 days of the next scheduled observation cycle for that domain. No email is required.

The DNS-based opt-out is preferred because it proves domain control without email exchange.

Email abuse@ciphercue.com from an address authoritative for the domain (e.g. security@yourdomain.com or abuse@yourdomain.com). Include:

Each domain you want excluded.
Whether the exclusion should cover subdomains (default: yes).
Any specific scope constraints (e.g. exclude observation but keep the entity record for named-breach signal matching).

We respond within 7 days with confirmation and the effective date.

All outbound probing: HTTPS GETs, DNS queries beyond what's needed to route email, TCP port enumeration, CT-log polling specific to the domain, TLS handshake observation.
All new derived observations against the excluded domain.

Ingestion of public breach disclosures and regulator enforcement actions where the entity is named in the authority record (e.g. a state Attorney General notification). These are authority records, not CipherCue-generated observations.
CT-log or DNS records that surface the domain as a side-effect of a scan of a different, non-opted-out domain. We filter these from storage where possible; where the domain surfaces via cross-reference, we retain only the authority-sourced record.

Remove the DNS TXT record or email abuse@ciphercue.com from an authoritative address requesting re-inclusion. The next cycle resumes within 7 days.

CipherCue publishes a directory of currently opted-out domains on request. Email abuse@ciphercue.com for the current list.

Changelog
v1.0 — 2026-04-28 — Initial publication of opt-out mechanisms.