Skip to content

EmailDNS and email security

Spoofing your domain is cheaper than breaking into it.

An attacker who wants your customers to trust an email has two options: compromise your mail system, or send from a domain that nobody configured to say no. The second is free. SPF, DKIM and DMARC are what close it, and most organisations have one of the three set up properly on their main domain and nothing at all on the eleven others they own. Nulink checks the published records on every domain you verify and tells you what an attacker can do with the gaps.

Book a demoOpen the platform

What it finds

  • Domains with no SPF record, or an SPF record that ends in a soft fail nobody enforces
  • DMARC policies published at p=none, which report spoofing without stopping any of it
  • Domains with no DMARC record at all, including ones that were never meant to send mail
  • DKIM selectors that are missing, misconfigured or publishing weak keys
  • MX configuration, including domains quietly accepting mail that should accept none
  • Dangling DNS records pointing at services that have been decommissioned
  • Any of these records changing between scans

Where the data comes from

  • Live DNS resolution
  • Passive DNS
  • SPF / DKIM / DMARC records
  • MX records

How it works

  1. 01

    Enumerate

    Every verified domain and the subdomains under it are listed, including the ones that have never sent an email.

  2. 02

    Resolve

    SPF, DKIM, DMARC and MX records are read as they are published to the internet right now.

  3. 03

    Assess

    Records are judged on what they actually enforce, not on whether they exist.

  4. 04

    Watch

    Rescans pick up changes, so a policy weakened during a migration does not stay weakened quietly.

In detail

The parked domains are the problem
Your primary domain usually has DMARC, because someone did that project. The brand you bought three years ago and never launched usually has nothing, and it is just as convincing in an inbox. Every verified domain gets the same checks, which is the only way this gets caught.
p=none is reporting, not protection
A DMARC record at p=none tells you about spoofing after it has happened. It does not stop a single message. Nulink reports the policy you have actually published rather than ticking a box for the presence of a record, because the difference is the entire control.
Sending domains and non-sending domains
A domain that sends no mail still needs a record saying so, or it is the easiest domain you own to abuse. Nulink flags both cases: the sending domain with gaps in its policy, and the silent domain with no policy to speak of.
Dangling records belong here too
A CNAME pointing at storage that no longer exists is subdomain takeover waiting for someone to notice. Those records are flagged with the target that failed to resolve attached as evidence.

What changes for your team

Harder to impersonate

Close the gap that makes your domain the cheapest way to phish your own customers.

Every domain, not just the main one

The protection is only as good as the weakest domain in your portfolio, and it is never the one you are thinking of.

Evidence for the auditor

Email authentication comes up in nearly every security questionnaire. Answer from the live record.

Especially useful for Startups.

What it doesn't do

Every tool has edges. Knowing where ours are is the difference between a control you can rely on and one you only think you have.

  • Nulink reads the records you publish to the internet. It does not send test messages and does not sit anywhere in your mail flow.
  • Record checks cover the domains you have verified. A supplier sending on your behalf from their own domain is outside this view.
  • Nulink does not receive or process your DMARC aggregate reports.

Questions about DNS and email security

We use a third party to send our mail. Does that change anything?

No, and it is the normal case. SPF is designed to authorise senders like that, and what Nulink checks is whether your record actually authorises the ones you use and refuses everyone else. A record that has accumulated six providers over five years, two of which you no longer use, is a finding worth having.

Why does a domain that sends no mail need DMARC?

Because an attacker can send from it. A non-sending domain with a strict policy is a domain nobody can use against your customers, and it is about five minutes of work per domain.

Does this replace a DMARC monitoring service?

No. Those services ingest the aggregate reports your policy generates and tell you who is sending as you. Nulink checks that the records are published and enforcing in the first place, which is the part people get wrong before they ever get to reports.

More in Nulink Exposure Management

See all capabilities

Visibility is security. Start with yours.

Book a 30-minute walkthrough with the team, or connect your first account and see results today.

Book a demoOpen the platform