Phylax · Exposure diagnostic

Exposure diagnostic report

A passive review of a company's public surface. It shows what an attacker would see before trying anything, without touching the client's systems.

Illustrative example · fictional data

Client

Inmobiliaria del Ejemplo SpA

Domain

cliente-ejemplo.cl

Date

August 2026

Type

Passive, non-intrusive

Executive summary

What we found, in short

The company has a tidy public presence and its website works well. The main problem is email. Right now the domain can be spoofed, so a third party could send messages that appear to come from the company and use them to deceive clients or suppliers. It is a concrete fraud risk and it is quick to fix. Alongside it there are minor configuration adjustments worth closing to leave the surface clean.

Overall risk medium-high

One high email-fraud finding, plus pending configuration adjustments.

Scope and method

What was reviewed and how

The diagnostic was done passively and on public information. No system was accessed, no passwords were tested and no load was placed on the client's servers. All work is carried out with written authorization and within the framework of Law 21.459 (the Chilean cybercrime law).

Email

The domain's SPF, DKIM and DMARC records, to see whether it can be spoofed.

Domain and DNS

Name configuration, visible subdomains and public records.

Web surface

HTTP security headers and the site's TLS certificate.

Public exposure

Visible traces in certificate transparency logs and search engines.

PTESOWASPNISTLaw 21.459 · authorized work

Findings

What was detected, by severity

High

Medium

Low

Informational

H-01Domain spoofable due to missing DMARCHigh

The domain has no DMARC policy published. In practice, anyone can send email that appears to come from the company. It is the usual gateway for email fraud, from a fake invoice sent to a supplier to a scam aimed at a client who trusts the sender.

RecommendationPublish a DMARC record, start in monitoring mode (p=none) to measure without breaking legitimate email, and move to reject once the flow is validated. It closes in days.

H-02Permissive SPF in softfail modeMedium

The SPF record ends in ~all (softfail), which flags unauthorized email as suspicious but does not block it. It leaves room for illegitimate messages to still reach the recipient's inbox.

RecommendationReview the real email sources, keep only the ones that belong and tighten the policy to -all once you confirm nothing legitimate is cut off.

H-03Missing HTTP security headersMedium

The site does not send several recommended security headers, such as HSTS and a content policy. It is not a flaw that gets exploited on its own, but it leaves the browser without protections that are standard today and makes other attacks on the visitor easier.

RecommendationAdd the missing headers at the server or the CDN. It is a low-effort configuration change with no impact on the user.

H-04Subdomains visible in Certificate TransparencyLow

Internal subdomains show up in the public certificate transparency logs, for example test environments and admin panels. It is not a leak, but it gives an attacker a map of where to start looking.

RecommendationReview which subdomains are still active, retire the ones no longer in use and keep the internal ones out of the public scope where possible.

H-05TLS certificate valid and due for renewalInformational

The site's certificate is valid and well configured. It expires within a few weeks. It is not a risk today, but if renewal is not automated, a missed date would leave the site flagged as not secure.

RecommendationConfirm that renewal is automatic and set an alert with enough margin before expiry.

Next steps

What I would do first

Close the spoofable email

Publish DMARC and tidy up SPF. It is the high finding and the one with the most impact for the least effort.

Harden the website

Add the missing security headers and confirm automatic renewal of the certificate.

Tidy the exposed surface

Clean up unused subdomains and take internal environments out of public view.

Domain Watch keeps this monitored

Once fixed, monthly monitoring checks SPF, DMARC, TLS and exposure, and alerts the moment something changes. USD 30 per month.

Note

Confidentiality

This document is an illustrative example. The client Inmobiliaria del Ejemplo SpA, the domain cliente-ejemplo.cl and every finding are fictional and were built only to show the Phylax deliverable format. A real report is prepared with data from a single client, shared privately and treated as confidential. It does not correspond to any real company or person.