Eleven domains, four surfaces, one table. The assessment method from the previous course, applied — and the output is a grid where every cell is a query result.
The estate
| Domain | Identity | Integrity | Transport | Tier |
|---|---|---|---|---|
calderandvoss.com | p=none, rua unread. SPF ok. No CAA. No transfer lock, shared login. | Unsigned | No MTA-STS, no TLS-RPT | Critical |
cv-industrial.com | p=none. No CAA. | Signed, RRSIG expired — SERVFAIL at validating resolvers | n/a while it does not resolve | Critical |
.de and .co.uk | Unknown. Records not under our control. | Unknown | Unknown | High |
| 4 parked domains | No DMARC, no SPF, no null MX | Unsigned | n/a | Critical |
| 2 parked domains with MX | Same, plus mail is receivable as the brand | Unsigned | n/a | Critical |
| The 2024 CNAME | Target does not resolve; claimable status unknown | — | — | Critical until disproved |
What ranks where, and why
CRITICAL, in this order: 1 Shared registrar login, no MFA, no transfer lock Undoes every other remediation. One hour to fix. 2 cv-industrial.com does not resolve A live outage. Validating resolvers get SERVFAIL, which includes a large share of the internet. 3 The 2024 dangling CNAME If the target is claimable, somebody can obtain a valid certificate for a calderandvoss name. 4 Six parked domains, completely open Anyone can send as any of them. Two can receive. 5 p=none on the primary Anyone can send as the company today.
Note that the unsigned primary domain does not appear in that list. It is a gap and nothing is currently exploiting it, and signing a zone the team cannot operate would introduce an outage mode they have already demonstrated with the marketing domain.
The expired signature is the finding that will surprise people
cv-industrial.com looks like the best-configured domain in the estate — it is the only signed one. It is also the only one that does not resolve for a validating resolver, and nobody has noticed because the people who would complain are using resolvers that do not validate.