Deep guides from
the diagnostic layer.
DNS records, email authentication, SSL, blacklists, domain reputation —
explained plainly and linked to the tools that check it live.
Enterprise Downtime Costs $300K/hr — And Why That's a Floor
Cost of downtime is the single most-abused number in security-budget requests. It's also one of the most rigorously measured. ITIC's 2024 survey pins the median mid/large enterprise at over $300K/hour; the top of the industry table clears $5M/hour. Here's how the number is built, why Gartner's $5,600/min baseline still holds up, and how to calculate your own.
What Is a Subdomain Takeover? (And Why Microsoft Had 670 of Them)
Subdomain takeover is the class of bug where a `CNAME` points to a service you already gave up — like an old S3 bucket, an expired Azure Cloud App, or a decommissioned Heroku dyno. An attacker registers the abandoned resource, and now they serve traffic from your subdomain.
What Is Typosquatting? (And How Zscaler Found 30,000 Lookalikes)
Typosquatting turns a spelling mistake into an attack surface. Zscaler ThreatLabz recorded 30,000+ lookalike domains targeting the top brands in a single 6-month window — roughly 200 per brand. Homoglyph, TLD-swap, brand-suffix, punycode. Every family explained, with the MyEtherWallet punycode incident as the canonical case.
DomainScan API + MCP: The Developer Guide
One JSON envelope across every tool. One API key. One MCP server. Everything the platform runs on is the same interface your code and your AI agent can hit — WHOIS, DNS, DMARC, SSL, blacklist, subdomain enumeration. Copy-paste examples in 8 languages, MCP config for Claude Code and Cursor, and the credit model explained in one page.
What Is an SOA Record? The DNS Zone's Control File Explained
The SOA record is DNS's control file — it governs zone transfers, cache TTLs, and negative response lifetimes. Every misconfiguration here ripples across every resolver on the internet.
What Is a Phishing Link? How to Spot and Avoid Them
Phishing links trick users into handing over passwords, credit card numbers, or installing malware — all by mimicking legitimate URLs. Here's how attackers build them and how to avoid the trap.
How DNS Propagation Actually Works (And Why 24 Hours Is a Lie)
DNS propagation isn't magical. It's a function of TTLs, resolver caches, and how you sequenced your DNS change. Understand the moving parts and you can plan changes with confidence — and know when '24 hours' is nonsense.
What Is a MAC Address? Hardware Identifier, OUI, and Privacy Explained
MAC addresses are the physical-layer identifiers that let switches and Wi-Fi access points route Ethernet frames. Every network interface has one, burned in at manufacture. Modern devices randomize MACs to defeat cross-network tracking.
CIDR Subnet Math Explained: /24, /16, /8, and Everything Between
CIDR notation is how modern networks are described: an IP address plus a slash and a number counting the network-prefix bits. Everything left of the boundary is the network; everything right is the host. The math is simpler than the notation makes it look.
What Is a CAA Record? Certificate Authority Authorization Explained
CAA turns your DNS into a whitelist for TLS certificate issuance. If an attacker tries to get a rogue cert issued for your domain from an unauthorized CA, the CA is contractually required to refuse the request when it checks CAA. Free defense against a real historical attack.
What Is DANE? TLSA Records and DNS-Anchored TLS Explained
DANE pins your TLS certificate in DNS. If DNSSEC is signed, and the TLSA record matches the cert your service presents, receivers can trust the connection without depending only on public certificate authorities. It's the most-adopted alternative to CA-based PKI — but it lives mostly in SMTP.
What Is Domain Age? Why It Matters for SEO, Trust, and Scam Detection
Domain age isn't just a novelty stat — it's a real signal downstream systems use to gauge trust. Old domains have historical reputation; newly-registered domains fit the profile of phishing, scam, and short-lived spam campaigns.
What Is a JWT? JSON Web Token Structure, Signing, and Security Explained
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.
HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options, and the Rest
HTTP security headers are the browser-enforced defence layer that runs before your application code. Deployed correctly, they eliminate whole classes of attacks — even when the underlying application has bugs. Deployed incorrectly, they silently break the site.
What Is Domain Reputation and Why Does It Affect Email?
Domain reputation is an invisible score that determines whether your email lands in the inbox or spam. It's set by Gmail, Outlook, and security vendors based on your sending history — and it can take months to build but days to destroy.
How to Read a DMARC Report (Aggregate XML Explained)
DMARC aggregate reports tell you exactly who is sending email as your domain, whether they pass authentication, and what action receivers took. Here's how to decode the XML and use it to harden your email setup.
DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and More
DNS records are the building blocks of how the internet resolves domain names to servers. Each record type has a specific job: routing web traffic, delivering email, proving domain ownership, or preventing spoofing.
What Is DMARC? How It Stops Email Spoofing
DMARC is the enforcement layer of email authentication. SPF and DKIM do the checking — DMARC tells receiving servers what to do when they fail, and reports back to you who's sending email using your domain.
What Is an SSL Certificate? TLS, HTTPS, and Trust Explained
SSL certificates are the foundation of HTTPS — they prove you're talking to the real server and encrypt everything in transit. Without one, browsers show security warnings and Google ranks your site lower.
What Is an SPF Record? Sender Policy Framework Explained
SPF tells the world which servers are allowed to send email on behalf of your domain. A missing or misconfigured SPF record lets spammers forge your address — and sends your legitimate email straight to spam.
What Is a Domain or IP Blacklist? How Blocklists Work
Blacklists are real-time databases used by email servers, browsers, and firewalls to block traffic from known bad actors. If your domain or IP is listed — even by mistake — your emails bounce and users see security warnings.
What Is DKIM? How DomainKeys Identified Mail Works
DKIM attaches a cryptographic signature to every email you send. Receiving servers verify the signature against a public key in your DNS — proving the message is authentic and untampered. No DKIM means anyone can forge your brand's email.