How security decisions get made, written out in full.
No gated PDFs and no webinars. These are the working methods behind a Warden assessment — how findings are ranked, what evidence counts, and how a decision is recorded so it holds up to a board or an auditor.
Run the method on your own domain first
The exposure check reads the two signals anyone can read without your permission — the DNS that says who may send mail as you, and the headers your homepage returns — and gives them back as prioritized findings, each with its evidence and one recommended action. Nothing is scanned and nothing is accessed.
Check your domain — free- Dataset · 4 min read
The dataset: every SPF chain and DKIM key we measured, as CSV
The data behind the 105-domain study, free and CC BY 4.0 with no email required: 742 DKIM keys with fingerprints so you can see which are byte-identical across companies, every SPF chain's authorized-address count, the method and the four limits that bound it.
- Original research · 10 min read
We measured the email authentication of 105 B2B SaaS domains. One DKIM key signs for 62 of them.
Original research from public DNS: 742 published DKIM keys that turn out to be only 446 distinct keys, a median domain authorizing 231,508 IP addresses to send as it, and 96 of 105 domains still publishing a 1024-bit key.
- Scope and limits · 8 min read
What a bounded $299 assessment can and cannot tell you
Eight questions buyers arrive with, and which of them external evidence actually reaches. What the Snapshot returns, the four alternatives that beat it at specific jobs, and the claims Warden does not make.
- Exposure teardown · 9 min read
SPF: too many DNS lookups — and the bigger number underneath it
Fixing a PermError gets mail flowing again; it does not reduce what the record trusts. A worked count on a real chain that authorized 1,086,996 addresses, and how to run the same count on your own domain in five minutes.
- Questionnaires · 8 min read
How to answer a customer security questionnaire without a security team
A questionnaire is an evidence-retrieval test, not a security test. The four answer states, the eleven artifacts that cover most of every questionnaire, and how to write a defensible “no” without stalling the deal.
- Prioritization · 7 min read
How to prioritize security findings when everything is labelled critical
CVSS scores a vulnerability, not the risk it carries in your estate. Three questions — reachability, exploitability, business relevance — with a worked reordering that puts one 9.8 first and an identical 9.8 last.
- Free tool · Original data
Shared DKIM key checker
The only check that compares your key material against other companies': 446 distinct public keys measured across 105 B2B SaaS domains. Names the other domains publishing the same key as you — in that sample, one key signed for 62 of them.
- Free tool · No sample email needed
DKIM selector finder
Every other DKIM checker asks for the selector you came to find. This one queries around a hundred documented provider defaults, reports which resolve, what key each holds, and whether it can still sign.
- Free tool · Runs in seconds
SPF DNS lookup checker
The count from the teardown, run as code: lookups against the limit of 10, and how many IPv4 addresses your record authorizes to send mail as you. Public DNS only, every record shown as evidence.
More are being written. If the instant check above surfaced something and you want the part a machine cannot read — a hand-researched Instant Security Exposure Check on your public surface, by email — ask for one here.