HADRIAN
Practice Lane 03 · Perimeter, DNS & Access Engineering

UNENFORCED DOMAINS INVITE SPOOFING AND SILENT SPAM FOLDERS.

Permissive SPF policies, missing DMARC enforcement, dangling DNS records, and over-privileged API tokens leave your brand open to impersonation and invoice fraud. We lock down your public domain perimeter, enforce cryptographic mail authentication, and isolate your production secrets.

Run Live Domain Scanner ↓ Request a Full Surface Audit →
Plate III · Cryptographic Mail, DNS & Access Perimeter Hadrian Systems · Security Engineering
Live Telemetry & Remediation Matrix

LIVE DOMAIN POSTURE SCANNER & AUDIT MATRIX

Real-Time DNS-over-HTTPS Inspector

Inspect Any Domain’s Live Mail & DNS Perimeter

Ready · Read-Only Public DNS Lookup
Quick test targets:
  • 01 · DMARC Policy (_dmarc) READY

    Anti-spoofing policy enforcement check

    Click “Inspect Live Domain” to query authoritative _dmarc TXT record.
  • 02 · SPF Sender Policy (TXT) READY

    Authorized outbound mail server boundary

    Checks root TXT records for v=spf1 and strict -all / ~all qualifier.
  • 03 · Inbound Mail Routing (MX) READY

    Primary mail exchange & gateway topology

    Verifies active MX gateways and null-MX posture on non-sending domains.
  • 04 · Certificate Authority Lock (CAA) READY

    TLS certificate issuance restriction

    Checks DNS CAA records restricting which CAs may issue SSL certificates.

Queries live authoritative DNS records directly from your browser via encrypted DNS-over-HTTPS. Non-intrusive and read-only.

Send Findings to Scope Brief →

01 · Mail Authentication — Cryptographic Sender Alignment

Every workspace, CRM, and transactional receipt sender must authenticate cleanly so third parties cannot spoof your executive domain and legitimate client mail never lands in spam.

SPF (Sender Policy Framework)
Declares the exact IP ranges and cloud relays authorized to send mail for your domain (<= 10 DNS lookups).
DKIM (DomainKeys Identified Mail)
Attaches a 2048-bit cryptographic signature to outbound headers proving the message was not altered in transit.
DMARC (Domain-based Auth)
Instructs receiving servers to quarantine or reject unaligned mail and sends aggregate telemetry reports.
  1. 01

    SPF Flattening & Qualifier Hardening

    Consolidate authorized senders (Google Workspace, Microsoft 365, Postmark, Stripe, CRM) under the 10-lookup RFC limit and remove permissive +all/?all rules.

  2. 02

    2048-Bit DKIM Selector Rotation

    Provision dedicated 2048-bit RSA DKIM keys across every active sending platform and purge orphaned selectors from retired vendors.

  3. 03

    Staged DMARC Enforcement (p=quarantine / p=reject)

    Move your domain safely from monitor-only (p=none) to full enforcement after verifying 100% of legitimate transactional and CRM mail passes alignment.

Hardening Sequence

HOW WE LOCK DOWN YOUR PERIMETER

  1. 01

    Non-Intrusive Perimeter & Zone Inventory

    We map every active subdomain, MX/SPF/DKIM/DMARC record, TLS certificate, and webhook endpoint across your public footprint—identifying spoofing gaps and dangling records before touching production.

  2. 02

    Staged Cryptographic & Header Rollout

    We align DKIM selectors and SPF includes for every legitimate sender first, verify DMARC telemetry reports, purge stale DNS pointers, and deploy hardened HTTP security headers with zero downtime.

  3. 03

    Credential Rotation & Custody Ledgers

    We rotate exposed API tokens, revoke former contractor seats, verify live inbox alignment, and deliver a complete asset and credential inventory owned exclusively by your principals.

Engineering Deliverables

SECURITY & SURFACE HARDENING SCOPE

  1. 01

    Cryptographic Mail Alignment (SPF / DKIM / DMARC)

    Complete authentication across your primary domain and parked lookalike domains so spoofed mail is rejected at the gateway.

    • SPF record consolidation kept strictly under the 10-lookup RFC limit across all active senders.
    • 2048-bit DKIM signing keys enabled for Google Workspace, Microsoft 365, CRM, and billing relays.
    • Staged DMARC transition from monitoring to enforcement plus null-MX lockdown on non-sending domains.
  2. 02

    DNS Zone Hygiene & Subdomain Remediation

    Line-by-line audit and cleanup of your authoritative DNS zone to eliminate takeover risks and undocumented shadow assets.

    • Removal of dangling A, AAAA, and CNAME records pointing to decommissioned cloud services.
    • Registrar lock verification, DNSSEC evaluation, and CAA record deployment.
    • Version-controlled zone backup and change log before and after every DNS modification.
  3. 03

    TLS, HSTS & Edge Security Headers

    Browser-enforced transport and framing protections deployed at your CDN or edge host without breaking analytics or checkout scripts.

    • HTTPS redirection, TLS 1.2/1.3 enforcement, and Strict-Transport-Security (HSTS) rollout.
    • Deployment of X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers.
    • Scoped Content-Security-Policy (CSP) rules tailored to your active front-end scripts.
  4. 04

    API Secret Isolation & Access Runbook

    Hardening of the keys, webhooks, and admin seats connecting your website, payment processor, and internal tools.

    • Migration of hardcoded keys into encrypted server-side environment variables and secret managers.
    • Revocation of former vendor seats, stale OAuth tokens, and over-privileged API tokens.
    • Written emergency revocation and key-rotation runbook delivered to your leadership team.
Operator Inputs

BEFORE WE BEGIN

What your team provides so remediation never interrupts legitimate mail or production web traffic:

  1. 01
    Domain & active sender inventory: Your primary and parked domains plus a list of services that send email on your behalf (Workspace, CRM, Stripe, Postmark).
  2. 02
    Scoped DNS & hosting collaborator access: Delegated access to your DNS zone (Cloudflare, Route53, registrar) and web host—never shared root passwords.
  3. 03
    Change-window sign-off contact: An operator designated to approve staged DNS updates and confirm seat revocations.
Acceptance Protocol

WHAT WE VERIFY BEFORE HANDOFF

Objective cryptographic and transport checks verified on live production before completion:

  1. 01
    Header & alignment verification: Live test emails from your inbox, CRM, and billing tools show spf=pass, dkim=pass, and dmarc=pass.
  2. 02
    Clean zone & TLS posture: All active subdomains resolve to verified hosts with valid TLS 1.3 certificates and enforced security headers.
  3. 03
    Zero lingering contractor access: Temporary Hadrian staging access is revoked in front of your team once the runbook is delivered.
Security FAQ

SCOPE, ROLLOUT SAFETY & ACCESS

How we harden DNS and mail records without disrupting daily inbox delivery, and how this differs from compliance theater.

Will tightening SPF, DKIM, and DMARC accidentally block our legitimate business emails?

Not when rolled out in the proper sequence. Amateur setups break email by jumping straight to p=reject before inventorying all sending relays. We audit every legitimate sender first, configure 2048-bit DKIM and clean SPF includes for each service, verify alignment via DMARC reports, and only enforce strict rejection once 100% of your real mail passes.

How does the live domain scanner on this page work?

When you enter a domain above, your browser queries Cloudflare’s public DNS-over-HTTPS resolver in real time to inspect your published _dmarc, SPF, MX, and CAA records. It is completely read-only and non-intrusive—showing the exact public posture external mail gateways and attackers see today.

Do we need to share root passwords for our domain registrar or cloud accounts?

Never. We work strictly through scoped collaborator roles (such as Cloudflare DNS administrator seats or delegated IAM roles) or screen-shared operator sessions. Once remediation and verification are complete, our collaborator seat is revoked.

Is this a SOC 2 compliance certification or penetration testing service?

No. We focus on practical engineering remediation of your public domain, email authentication, web edge headers, and webhook/API credential boundaries—fixing the concrete misconfigurations that actually cause domain spoofing, spam-folder placement, and leaked keys.

LOCK DOWN YOUR DOMAIN AND API PERIMETER.

Share your primary domain and we will inspect your live DNS, mail authentication, and edge header posture.

Request a Domain & Surface Audit →