Sh
sh.consulting
Email Security
Email Marketing
Cybersecurity
Claim pageClaim
Follow
Overview
News
Salaries
Products
People
Growth
Offices
Financials
News
The Abandoned Endpoint: How an Expired DMARC Reporting Domain Exposed 86 Domains Across 20+ Organizations
A lapsed DMARC reporting domain, re-registered for $10, collected aggregate reports for 86 domains across 20+ organizations. How it happened, and how to check yours.
Read more
Report
I Bought an Expired Domain for $10, and a NYSE Company's Customer Map Started Arriving Every Morning
A lapsed DMARC reporting domain, re-registered for $10, silently received the authentication reports of 86 domains for eight months. What the reports actually expose, and how to check your own.
Read more
Report
We Deployed APRF Across 100+ Domains: What the Reports Show
What Comcast's live APRF beta reports actually contain, why the numbers are bucket ceilings rather than counts, and how to deploy the DNS records at scale.
Read more
Report
A Lapsed Dover-Era Domain Is Still Leaking Email and DMARC Reports for JE Pistons and Wiseco
I registered a lapsed corporate domain and watched live mail and DMARC reports for JE Pistons and Wiseco flow to me. What leaked, and how to find the same gap.
Read more
Report
What 1,000% Open Rates Taught Us About Detecting Hijacked Email Accounts
A single message showing a 1,000% open rate isn't a great campaign - it's a compromised account. How DKIM replay works and how to detect it from your dashboard.
Read more
Report
The List-Unsubscribe Header: Why SendGrid Adding It Isn't Enough
SendGrid writes the List-Unsubscribe header automatically, but Gmail decides whether the unsubscribe button renders. Why reputation, not config, controls it.
Read more
Report
Hazy Hawk Hijacked Subdomains at MIT, Harvard, Stanford, and 30+ Other US Universities
Alex Shakhov discovered Hazy Hawk hijacking .edu subdomains at 34 US universities including MIT, Harvard, and Stanford to serve explicit content indexed by Google.
Read more
Report
How to Secure Parked Domains: The DNS Records Almost Nobody Adds
Null MX, SPF -all, DMARC p=reject, and wildcard DKIM revocation: the four DNS records that stop email impersonation from your parked domains.
Read more
Report
Email Deliverability Isn't About Engagement - It's About Security
Engagement matters, but email deliverability is built on security. Without DKIM, SPF, and DMARC, no strategy will save your inbox placement.
Read more
Report
Microsoft 365 Groups Bypass DMARC, Exposing Organizations to Spoofing
Microsoft 365 Groups can deliver spoofed emails despite failing SPF, DKIM, and DMARC enforcement. Learn how this design gap exposes organizations to risk.
Read more
Report
Show more news