Before
Security teams had to run DNS lookups, subdomain searches, mail-security checks, and public asset queries across separate tools. They then copied results between tools, interpreted the findings, classified discovered hosts, and assembled the assessment report manually.
How it works
- The scheduled flow discovers subdomains, nameservers, MX records, and related DNS data for the target domain.
- It validates DNS behavior, checks mail-security configuration, examines exposed services, and applies rules to classify assets and assign confidence.
- It merges the assessed sections into a markdown report containing a TL;DR summary and follow-up actions.
Workflow details
- Scope discovery: The workflow starts with a configured target domain, enumerates its subdomains, identifies nameservers and MX records, and prepares the discovered hosts for further assessment.
- DNS security assessment: For each nameserver, it resolves the server address, performs lame delegation checks, attempts a zone transfer, tests recursive behavior, and reviews exposed services and ports. DNS records are also evaluated for A, AAAA, CNAME, TXT, SPF, and related relationships.
- Email security assessment: The workflow checks MX records and runs SMTP, SPF, and DMARC assessments. Results are grouped into passed, failed, warning, timeout, and informational findings so the report can describe the security posture of mail-related infrastructure.
- Public exposure and role analysis: Discovered hosts and resolved IP addresses are checked for publicly visible services, software details, open ports, and reported vulnerabilities. Automated reasoning applies a defined ruleset to classify host roles, add supporting evidence, and assign confidence levels.
- Report generation: Findings are cross-checked in report sections, merged, and converted into a consolidated markdown assessment covering DNS, mail security, subdomains, and exposed infrastructure, followed by a summary and recommended follow-up actions.
What changed
The complete assessment is generated on schedule from one target-domain input. DNS, mail, subdomain, and public-exposure checks are performed consistently, findings are classified and cross-checked automatically, and the final report is assembled without a manual reporting handoff.
Work removed
Manually running repeated DNS, subdomain, MX, SMTP, SPF, and DMARC checks; resolving nameservers and testing zone transfers or recursion; searching discovered IPs for exposed services and vulnerabilities; classifying hosts; copying findings between tools; and writing the assessment report and follow-up summary.
Expected outcome
Approximately 45–90 minutes of recurring assessment work can be removed per domain and assessment cycle, with consistent coverage of the configured DNS, mail-security, subdomain, and public-exposure checks.
