What to do with no budget — Domain Trust Architecture

A meaningful share of domain trust costs nothing but an afternoon and a DNS change. Knowing which parts those are lets a programme start before any budget conversation happens.

The free list

Action	Time	Risk
MFA and individual logins on the registrar account	An hour	None
A recovery address on a domain the account does not control	Minutes	None
`rua` on every domain in the estate	An hour	None. It changes no delivery.
The non-sending set on parked domains	An afternoon, generated	None, after a fortnight of `rua` confirms they send nothing
`np=reject` on every domain	Minutes	None. Non-existent subdomains have no legitimate senders.
A CAA record naming the CA you already use	Minutes	Low. Pin the CA only, not the account.
Removing dangling CNAME, NS and MX records	An afternoon	Low, once you have confirmed the target is genuinely gone
TLS-RPT	Minutes	None. One TXT record with no failure mode.
Forward-confirmed reverse DNS on sending hosts	An hour	None
Auto-renew and a calendar reminder on every domain	An hour	None

If you only do three

1  Registrar MFA
   Removes the single highest-impact compromise route.

2  rua everywhere
   Starts the evidence clock. Everything later needs it.

3  The non-sending set on parked domains
   Usually the majority of the estate, from completely
   unprotected to fully protected, with no legitimate
   sender to break.

That is under a day of work and it is more risk reduction than most funded projects deliver, because it addresses the two things most estates are worst at: an unprotected registrar account and dozens of forgotten domains carrying the brand.

What is not on the list

DMARC enforcement, MTA-STS, DANE and BIMI all cost something — evidence time, vendor negotiation, infrastructure or money. They belong in the funded programme. Everything above belongs in this week, and doing it first makes the funding conversation easier because there is already something to point at.

Two weeks of rua before the strict set

“Parked” sometimes means “parked, except for the contact form somebody set up in 2019”. The fortnight of reports costs nothing and is the difference between locking down a dormant domain and silently killing a form nobody remembers.

Knowledge check

With no budget and one day, which three actions deliver the most risk reduction?

Registrar MFA, rua on every domain, and the strict record set on confirmed non-sending domains.
Move the primary domain to p=quarantine, publish CAA, and deploy MTA-STS.
Sign the zone with DNSSEC, publish TLSA records, and enable DANE.
Buy a monitoring service, register defensive domains, and file takedowns.

Correct — Registrar MFA, rua on every domain, and the strict record set on confirmed non-sending domains. They address the two things most estates are worst at — an unprotected registrar account and dozens of forgotten domains carrying the brand — and they start the evidence clock everything later depends on.

Not this — Move the primary domain to p=quarantine, publish CAA, and deploy MTA-STS. The first needs weeks of evidence, and MTA-STS needs a policy host and a certificate. Only CAA fits in a day.

Not this — Sign the zone with DNSSEC, publish TLSA records, and enable DANE. DNSSEC is a real project with an ongoing operational burden, and the TLSA records belong under the MX hostnames, which may not be your zone.

Not this — Buy a monitoring service, register defensive domains, and file takedowns. All three cost money, and defensive registration is the control with the worst return per pound.