Ranking by consequence

After this lesson you can

Order findings by what each one actually permits, not by how easy it is to describe.

Assumes you have read Fifteen minutes of public DNS.

A cold audit produces a dozen observations. Most tools present them as a list with red and amber badges, which is how a genuine spoofing exposure ends up ranked alongside a missing optional tag.

The only question

What does this finding permit that would otherwise be impossible? If the answer is “nothing”, it is not a finding. If the answer is “anyone can send invoices as this domain”, it goes at the top regardless of how easy it was to spot.

A ranking that holds up

Tier	Findings	Permits
Critical	No DMARC record, or `p=none`. SPF ending `+all`. Dangling `_domainkey` CNAME into claimable infrastructure.	Authenticated or unchallenged mail as the domain, by anyone.
High	SPF at permerror. `p=quarantine` with unidentified failing sources. A forgotten `p=none` on a sending subdomain.	Spoofing that mostly works, or an enforcement that does not apply where it matters.
Medium	Enforcing with no `rua`. 1024-bit keys. `t=y` in production. Unrevoked old selectors.	No visibility, or a weakness that needs another factor to exploit.
Low	No MTA-STS. Missing null MX on a parked domain. No CAA.	An attack that requires a position on the network, or a gap with no current exploitation path.
Not a finding	Defaults not stated explicitly. `ri` or `rf` absent. No BIMI.	Nothing.

Two ranking traps

"The SPF record is missing an ip4 for a server we found."
   -> Not a finding unless that server sends. An overlong
      SPF record is the more common real problem.

"p=reject is set, so email security is complete."
   -> Check whether mail passes. An enforcing policy over
      failing mail is an outage waiting for someone to
      notice, not a finished programme.

A tool score is not a ranking

Automated graders weight what they can parse, so a domain with p=reject, a 1024-bit key and three unidentified senders scores well while a domain at p=none with immaculate everything else scores badly. The second is the one anyone can spoof today.

Knowledge check

Domain A: p=reject, 1024-bit DKIM key, no MTA-STS. Domain B: p=none with rua, 2048-bit keys, MTA-STS enforcing. Which has the more serious finding?

Domain B — p=none means anyone can send as it today, which the other findings do not offset.
Domain A — a 1024-bit key is a cryptographic weakness and those are always most serious.
Domain A — missing MTA-STS leaves mail interceptable.
Equally serious — both have multiple findings.

Correct — Domain B — p=none means anyone can send as it today, which the other findings do not offset. Rank by what a finding permits. B has excellent hygiene around a policy that asks receivers to do nothing. A’s weak key and missing transport policy both require an attacker to achieve something difficult first.

Not this — Domain A — a 1024-bit key is a cryptographic weakness and those are always most serious. Factoring a 1024-bit key is a laboratory undertaking. Sending as a domain with p=none requires an SMTP client.

Not this — Domain A — missing MTA-STS leaves mail interceptable. It requires an on-path position. Spoofing B requires nothing at all.

Not this — Equally serious — both have multiple findings. Counting findings is what tool scores do. The question is what each one permits.

Last reviewed 2026-09-15

Ranking by consequence

The only question

A ranking that holds up

Two ranking traps

Try it on a real domain