Thirty days of work that needs no budget, no vendor and no approval beyond a DNS change — and which includes the two live incidents.
Week one
| Action | Why now | Owner |
|---|---|---|
| MFA and individual logins on the registrar account; enable transfer lock | It outranks every other finding and takes an hour | IT |
Resolve the cv-industrial.com signature failure — provider first, remove the DS if not fixed same day | A live outage for validating resolvers | DNS owner |
| Capture evidence on all five lookalike domains | Unrecoverable once a host acts | Security |
| Report the live phishing domain: host, registrar, and safe-browsing in parallel | The earning window is now | Security |
Publish rua on all eleven domains | Starts the clock everything else depends on | DNS owner |
| Capture, then remove, the 2024 dangling CNAME — after a CT check | Possible active takeover | DNS owner |
Weeks two to four
Resolve every CNAME, NS and MX target in every zone. Expect more dangling records than the one in the brief. Publish the non-sending set on the four parked domains with no MX: v=spf1 -all _dmarc p=reject; sp=reject; np=reject; rua=... *._domainkey v=DKIM1; p= MX 0 . The two parked domains WITH MX: rua only, for a fortnight. Find out whether anything is reading that mail before removing the ability to receive it. Publish CAA on every domain, naming the CA in use. Publish np=reject everywhere. Establish the registrar, expiry and registrant of the .de and .co.uk domains. Start the recovery track.
What is true at day thirty
The registrar account is defensible. A live outage is over. An active phishing campaign has been reported and interrupted. Six of eleven domains have gone from completely open to fully locked down. Reporting is running everywhere, so the sender inventory is accumulating. And nothing has required money or a vendor.
The primary domain has not moved
It is still at p=none after thirty days, and that is correct — the sender inventory does not exist yet, and moving without it is how a company rejects its own invoices. Saying this explicitly at the start prevents it being read as the plan stalling.