Skip to content
Keel Docs

Discover vendors from your domain

Most vendor registers start as a blank table, and the first honest answer to “which third parties touch our data?” is usually “the ones somebody remembered”. Keel can give you a starting list instead, built from records your organization has already published to the public internet.

Nothing is added to your register automatically. Discovery proposes; a person accepts.

Where to run it

Section titled “Where to run it”

There are two entry points, and they run the same engine.

  • The free tool, at keelgrc.com/tools/vendor-discovery. No account, no signup. Enter a domain, see what it declares. Results are not saved anywhere and nothing is written to a workspace.
  • In the app, at /welcome/vendors during onboarding, and re-runnable at any time from Settings → Vendor discovery. Here you can accept proposals into your vendor register.

Skipping the onboarding step costs you nothing — you get the normal empty register and add vendors by hand. It is an accelerant, never a gate.

What it reads

Section titled “What it reads”

Everything below is public, and reading it is the same act as visiting the site or querying a public DNS record.

Signal What it usually means
DNS TXT records Domain-verification tokens — someone proved ownership to that vendor
SPF includes Services authorized to send email as your domain
MX hosts Who runs your mail
DMARC reporting address Where your DMARC reports are sent
CNAME targets Where a subdomain points
NS hosts Who runs your DNS
Your site’s Content-Security-Policy Third-party origins your homepage is allowed to load

DNS is read over DNS-over-HTTPS against a public resolver, so the domain’s own nameservers never see the query. The Content-Security-Policy comes from a single ordinary GET of the homepage, which appears in that site’s access log as one request identifying itself as Keel.

What it will never do

Section titled “What it will never do”

This is stated as a limit, not a roadmap item. Discovery is passive, in every version:

  • No port scanning.
  • No directory or path guessing.
  • No admin-panel probing.
  • No credential testing.
  • No payload injection.
  • No request a normal visitor’s browser would not make.

It also collects no data about individuals. The signals are organizational.

Confidence: declared, observed, inferred

Section titled “Confidence: declared, observed, inferred”

The grouping is the point, and it decides what arrives ticked.

  • Declared — the organization publicly said it. A verification token in your DNS is something somebody deliberately published to prove ownership to that vendor. An SPF include is your organization authorizing that service to send mail as you. These arrive pre-selected.
  • Observed and inferred — Keel concluded it. A CNAME proves where a name points, which is a weaker fact: a subdomain aimed at a service you stopped paying for looks identical from outside to a live integration. These arrive deselected.

A checkbox that starts ticked implies Keel is confident. On the observed and inferred rows it is not, so they do not.

Every row carries its evidence

Section titled “Every row carries its evidence”

Each proposal quotes the record it came from in plain language — “docusign=… — found in a DNS TXT record” — along with the source URL that was read and the timestamp it was read at. You are meant to check the finding rather than take Keel’s word for it.

Accepting proposals

Section titled “Accepting proposals”

Tick the rows you recognize and accept them. Keel either links the proposal to a vendor already in your register or creates a new one, and reports which of the two it did.

Re-running discovery later will not re-propose anything you already accepted or rejected, so a second run shows you what has changed rather than the same list again.

What the results are not

Section titled “What the results are not”

A starting point for a third-party register, not a complete one. A vendor that touches your data but appears in none of your public records — no verification token, no mail path, nothing loaded by your homepage — is invisible to this and still belongs in your register. Discovery shortens the blank-page problem; it does not certify that a register is complete.

Next steps

Section titled “Next steps”