DNS & Email Security
Email-based attacks — phishing, BEC, spoofing — depend on weak or absent DNS authentication records. D3 checks all nine records that determine whether a domain is defensible against email-based impersonation, and maps findings directly to NIS2 Article 21 and ISO 27001:2022 controls.
SPFDKIMDMARCBIMIMTA-STSDANE/TLSACAATLS-RPTDNSSECWHOIS & RDAP
D3 queries RDAP (Registration Data Access Protocol) as the primary source — using IANA bootstrap to route to the authoritative registry for each TLD. For TLDs without RDAP support, D3 falls back to classic WHOIS via TCP port 43. All data is retrieved from the authoritative source, not a third-party aggregator.
The accredited registrar managing the domain registration.
Organisation or individual that owns the domain. Often WHOIS-privacy protected under GDPR.
When the domain was first registered. Short history may indicate a newly set-up phishing domain.
When the registration lapses. Domains expiring within 30 days are flagged — a lapsed domain can be acquired by a third party.
Registry-level locks (clientTransferProhibited, serverDeleteProhibited etc.) indicating the domain's transfer and deletion protection state.
Authoritative DNS servers for the domain. Shared with a known registrant is strong evidence of common ownership.
Whether the domain has DS records published at the registry, indicating active DNSSEC deployment.
Change Monitoring
Domain hijacks and infrastructure compromises rarely happen all at once. They leave traces: a nameserver change here, a new TLS certificate there. Change Monitoring runs continuously and alerts you the moment something changes — giving you time to respond before an attack completes.
What is monitored
A, AAAA, MX, NS, TXT, CAA — any addition, removal or modification is detected and alerted.
Registrant, registrar, expiry date, EPP status, nameservers — changes may indicate a transfer or hijack attempt.
Certificate issuance, renewal or change — unexpected new certificates are a strong indicator of domain hijack or MITM setup.
Policy weakening (e.g. DMARC from 'reject' to 'none') is a common attacker move after gaining access.
Attack scenarios detected
Run a full technical analysis
Free account. 3 trial credits. No credit card required.