Henkeimcps.workDigital Trust in Practice

Home / Student Subdomains / Terms

Terms of use · Acceptable use

Subdomain Terms.

Plain terms for a free service. Read them before you claim a name: claiming one means you accept them.

What you get

One subdomain of mcps.work, free of charge, for as long as you keep renewing it. You choose the name, subject to the reserved list. You can point it at your own hosting, or delegate it to your own nameservers and run the zone yourself.

You do not get: hosting, email, a database, backups, a service level, or any guarantee that the name will still exist next year. This is a free service run alongside other work.

Who can claim one

Students. One name per person. Claiming more than one by using several email addresses is a reason to remove all of them.

We may require an institutional email address. If enrolment is restricted, the sign-in page will simply refuse other addresses.

Renewal and expiry

We email you once a year at the address you signed in with. Confirm that you still want the name and it stays. If you do not respond within 30 days, the name is released and becomes available to someone else.

Keep your email address working. A name whose owner cannot be reached will be released, because an unreachable owner means we cannot act on an abuse report.

Acceptable use

Do not use a subdomain of mcps.work for any of the following. Each one gets the name removed, usually without notice:

  • Phishing, credential harvesting, or any page that imitates another organisation, person or login screen.
  • Malware, ransomware, exploit kits, or command-and-control infrastructure.
  • Impersonating Henkei Corporation, mcps.work, or any of its services. The reserved list blocks the obvious names; the rule covers the rest.
  • Content that is illegal under the law of Sri Lanka, including material that infringes copyright or trademarks.
  • Sending unsolicited bulk email from the name, or using it in the envelope or headers of such mail.
  • Proxying, tunnelling or URL-shortening services that let a third party publish content under your name.
  • Reselling, renting or transferring the name to anyone else.

If you are running a security experiment that could look like any of the above, ask first at abuse@mcps.work.

Technical requirements

HTTPS is not optional. This domain sends HSTS with includeSubDomains. A name served over plain HTTP will be unreachable in browsers, for up to a year, with no useful error message. Every host you point at must serve a valid certificate.

If you delegate the name to your own nameservers:

  • Publish your own CAA record at your zone apex if you need a specific certificate authority. A certificate authority validating a name in your zone walks up the tree to mcps.work, so our record can otherwise constrain you.
  • Publish your own SPF and DMARC records if you send mail. Our wildcard records do not reach below a delegation, so your names are not protected from spoofing unless you protect them.
  • Keep at least two working nameservers. A delegation that stops answering will be removed.

Removal and appeal

We remove a name when it breaks these terms, when it is reported and confirmed as abusive, when a registry, registrar, browser vendor or blocklist provider requires it, or when it puts the rest of the domain at risk. We will tell you at your registered address, except where telling you first would let the harm continue.

If you think a removal was wrong, reply to that email. We will look at it again. There is no formal appeal process beyond that.

We may also withdraw the whole service, with or without notice. If we do, we will give existing holders as much warning as circumstances allow.

Your data

We store your email address, the name you hold, its DNS configuration, and the dates you claimed and last renewed it. We use the address only to operate the service: sign-in codes, renewal reminders, and abuse notices.

The name you hold is public: it is in the public DNS, and it appears in the directory on the claim page. Your email address is never published.

We keep your record for as long as you hold the name, and delete it within 90 days of release. To see or delete your data, email info@henkeicorp.com. This processing is covered by the website privacy notice and Sri Lanka's Personal Data Protection Act.

Where your data is processed. This service runs on Microsoft Azure in the West US 2 region, in the United States. Your email address and the details of the name you hold are stored there, not in Sri Lanka. Under the Personal Data Protection Act that is a cross-border transfer, and you are agreeing to it by claiming a name. If you would rather not, do not claim one.

No warranty, no liability

The service is provided as it is, with no warranty of any kind. We are not liable for any loss arising from its use, its unavailability, the removal of a name, or anything published on a name, yours or anyone else's. If a court finds that some liability cannot be excluded, it is limited to the amount you paid us for this service, which is nothing.

These terms are governed by the law of Sri Lanka.

Report abuse

If a name under mcps.work is being used for phishing, malware or anything else on the list above, email abuse@mcps.work with the full hostname and what you observed. We read that address and act on it.

Last updated 19 September 2026. We may change these terms; the current version is always the one on this page.