DNS and Email Authentication
NullFault checks public DNS records like SPF and DMARC that influence whether attackers can spoof email from your domain or whether mail setup looks incomplete.
What NullFault Checks
- Whether SPF and DMARC records are present and coherent.
- Whether policies look overly permissive, duplicated, malformed, or stuck in monitoring-only mode.
- Whether mail-routing signals look consistent enough for a launch-readiness review.
Why It Matters
- Weak email authentication makes it easier to send phishing that appears to come from your domain.
- DNS record mistakes can reduce deliverability or make legitimate messages harder to trust.
- Attackers often exploit new products before customers learn what real emails look like.
Common Causes
- Never publishing SPF or DMARC records for the domain.
- Leaving DMARC at p=none long after launch.
- Multiple conflicting SPF records from different providers.
Check it yourself
Look up your domain's TXT records for SPF and the _dmarc subdomain for DMARC. Missing records, or DMARC set to p=none, means weak protection.
Mitigation
- Publish one clear SPF record that matches your actual sending providers.
- Move DMARC toward enforcement (p=quarantine or p=reject) after reviewing reports.
- Configure DKIM with your email provider and verify alignment.
- Review email authentication before campaigns, invites, password resets, and billing emails go live.
Reality check
Email DNS is operational security. It may not block a web launch, but it matters before users start receiving messages from the product.