Recon Report
Email Spoofability Can you spoof email from this domain? Partially DMARC present but no SPF
SPF — Sender Policy Framework
RFC 7208 — Sender Policy Framework
SPF allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. Without SPF, any server can forge the envelope sender.
DKIM — DomainKeys Identified Mail
RFC 6376 — DomainKeys Identified Mail
DKIM provides cryptographic authentication of email messages. Selector names often reveal email providers (e.g., google, selector1 = Microsoft 365).
DMARC — Domain-based Message Authentication
RFC 7489 — DMARC
DMARC ties SPF and DKIM together with a policy that tells receiving servers what to do with unauthenticated mail. p=none is monitoring only — attackers love it.
Transport Security Can you intercept email in transit? No No MTA-STS or DANE — mail transport encryption is opportunistic only
DANE / TLSA
MTA-STS
TLS-RPT
RFC 8460 — SMTP TLS Reporting
TLS-RPT enables reporting of TLS negotiation failures. Without it, STARTTLS downgrade attacks leave no trace.
Brand & Certificate Security Can you fake this brand's identity? Likely DMARC quarantine flags but does not reject spoofed mail (RFC 7489 §6.3), and no BIMI brand verification — lookalike domains display identically in inboxes; CAA restricts certificate issuance (RFC 8659 §4) but visual brand faking remains open
BIMI
CAA — Certificate Authority Authorization
RFC 8659 — CAA
CAA records specify which Certificate Authorities are authorized to issue certificates. Without CAA, an attacker could obtain a valid cert from any CA.
DNS Infrastructure Can you poison the DNS? Possible DNSSEC signed (DNSKEY + DS present), but chain-of-trust validation was not confirmed on our resolver path (AD flag unset, RFC 4035 §3.2.3) — protection depends on the client using a validating resolver
DNSSEC
RFC 4033–4035 — DNSSEC
DNSSEC adds cryptographic signatures to DNS responses, preventing cache poisoning and response forgery. Without DNSSEC, an attacker can forge DNS answers.
NS Delegation
biospace.production.k1.m1.brightspot.cloud
d2b0owo2iyixaa.cloudfront.net
ns-1143.awsdns-14.org
ns-129.awsdns-16.com
ns-1908.awsdns-46.co.uk
ns-681.awsdns-21.net
DNS Provider
Attack Surface Discovery What can you find from the outside?
Subdomain Discovery (Multi-Source)
SaaS Services (TXT Record Discovery)
Secret Exposure
Intelligence Metadata Can you verify this independently?
350e7184be1a9a7703f0fee8b183e018d00a21541697b340e4954a97652292fcace770853ba58422960f4ca4614c915120887014cdc09d35ce925a5bbd68b020
716aab31dbaec283…