In-depth guides to understand every finding DomainRisk.io surfaces — what it means, why it matters and exactly how to fix it.
Latest articles
Finding lists are useful — but they are not decisions. A domain security score collapses dozens of signals into a single number with clear thresholds. Here is how it is built, what each band means, and why a guardrail prevents a 90/100 from hiding a critical flaw.
Registration age, registrar reputation, WHOIS redaction, DNS configuration, SSL metadata, typosquatting distance, subdomain proliferation — none is sufficient alone. Here is how to combine all seven signals into a composite risk verdict.
Without DKIM, your emails carry no cryptographic proof of origin — and your DMARC policy rests on SPF alone, which breaks under forwarding. Learn how DKIM works, how to configure it for every sending service, and how to rotate keys safely.
A missing SPF record leaves your domain open to spoofing. A broken one silently blocks your own email. Learn how SPF works, what every mechanism does, and how to avoid the 10-lookup trap.
Every subdomain you ever created left a DNS record. Every cloud service you ever cancelled left a CNAME pointing nowhere. Attackers scan for these orphaned records systematically — here is how to find them first.
By default, any certificate authority in the world can issue an SSL certificate for your domain. A single DNS record — the CAA record — restricts that authority to a whitelist you control.
A valid SSL certificate is not the same as a secure connection. SSL Stripping attacks exploit the gap between the two — and HSTS is the only mechanism that closes it permanently.
SPF and DMARC protect the envelope — but the transport pipe between mail servers can still be intercepted. MTA-STS forces TLS encryption on every SMTP connection and makes downgrade attacks technically impossible.
When DomainRisk.io flags your domain for a missing DMARC record, it means anyone can send email impersonating you. Learn what DMARC is, why it matters and how to implement it step by step.
Every article in this knowledge base maps to a real finding DomainRisk.io can detect automatically. Add your domain and get a full WHOIS, DNS, SSL and email-auth report in under 60 seconds.