---
title: "What are the Applicant's websites / domains (main website, corporate email domains, subsidiary/franchise sites)?"
url: https://insuranceposture.com/questions/governance-and-workforce/applicant-s-websites-domains
category: "Governance and workforce"
canonical_key: q_gov_011
evidence_state: partial
updated: 2026-08-24
---

# What are the Applicant's websites / domains (main website, corporate email domains, subsidiary/franchise sites)?

URL: https://insuranceposture.com/questions/governance-and-workforce/applicant-s-websites-domains
Section: Governance and workforce
Evidence state: Partly verifiable from your tenant

This list defines what is insured and what gets scanned. Both reasons argue for completeness.

## What the carrier is actually asking

The carrier wants your main website, corporate email domains, and any subsidiary, franchise, or campaign domains. It uses the list for coverage scope and, increasingly, as the input to an external scan.

## Why it is underwritten

Coverage for a website usually attaches to the domains disclosed. External scanning also starts here, so the list determines what the underwriter sees before quoting. Domains omitted are both uninsured and unassessed, and the second sometimes helps until the first matters.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Domain ownership is partly discoverable and worth reconciling before answering, because most organisations own more domains than anyone can list from memory.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Registrar | All domains registered to the organisation and to individuals within it | A complete list, including defensive registrations and domains held in personal accounts |
| DNS | Active domains with published records | Which domains actually resolve and serve content, since dormant ones carry different exposure |
| Microsoft 365 | Verified domains in the tenant | Every domain configured to send mail, which is also the list that needs email authentication records |
| Certificates | Certificate transparency logs for your domains | Subdomains and services you did not know were published |
| Acquisitions | Domains inherited from acquired entities | Included, since they frequently still serve content and send mail |

**Domains in personal accounts**

Marketing campaign domains and early company registrations frequently sit in an individual employee registrar account, paid on a personal card. They serve real content, they can send mail as your brand, and they are outside every control and every renewal process.

## What a defensible yes requires

- The list is compiled from registrar records rather than from memory.
- It includes acquisition and subsidiary domains.
- Domains held in personal accounts are identified and transferred.
- Every mail-sending domain has authentication records published.
- Dormant domains carry restrictive records so they cannot be spoofed.

## How this answer goes wrong

The main domain is listed and a dozen others are not, several of which send mail on behalf of the business. Those domains are outside the coverage scope and outside the email authentication answer given elsewhere on the form.

## If this answer turns out to be wrong

The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Do we need to list every domain?

List everything active, and defensive registrations too where the form allows. Omission means no coverage for that asset.

### What about subdomains?

Usually covered by the parent domain. Certificate transparency logs are the fastest way to find subdomains you had forgotten.

### Does the carrier scan these?

Increasingly yes, before quoting. Assume the list you provide is the list that gets scanned.

### What about domains we no longer use?

Keep them registered with restrictive email authentication records. A lapsed domain can be re-registered by anyone and used to impersonate you.

## Related questions

- [Does the Applicant employ SPF, DKIM, and DMARC?](https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc)
- [Can network ports only be opened with a legitimate business need? Port accessibility regularly verified?](https://insuranceposture.com/questions/network-and-logging/can-network-ports-only-opened-legitimate-business-need-port)
- [What percentage of hardware/software connected to network is inventoried?](https://insuranceposture.com/questions/network-and-logging/percentage-hardware-software-connected-network-inventoried)
- [Any significant changes in nature or size of business anticipated next 12 months (M&A, consolidation)?](https://insuranceposture.com/questions/business-profile/significant-changes-nature-size-business-anticipated-next-12-months)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.