We checked the public DNS records of 15,704 companies from Seed through Series D. We found that as companies continue to raise more money, they get a better handle on their email security and also the risk to their estate. From the email perspective, they implement DMARC policies that make it harder for spammers to impersonate their domain and enable reporting to see when those kinds of attacks happen. They also carry less takeover risk: by Series D fewer than 2% of companies have a dangling subdomain that an outsider could claim, down from 4% of Series A companies.
Fixed by the time they raise a C or D
| Finding | Seed | Series A | Series B | Series C | Series D | Trajectory |
|---|---|---|---|---|---|---|
| DMARC policy none (p=none) | 50.8% | 39.2% | 32.8% | 27.3% | 25.2% | ↓ halved |
| DMARC without reporting | 28.8% | 20.6% | 16.9% | 13.1% | 11.2% | ↓ 61% |
| No DMARC record | 23.5% | 18.0% | 14.6% | 23.8% | 11.4% | ↓ halved |
| No SPF record | 13.0% | 8.5% | 6.2% | 10.8% | 6.0% | ↓ halved |
| Claimable dangling name (subdomain takeover) | 3.0% | 3.9% | 2.7% | 1.9% | 1.8% | ↓ 40% |
Companies checked: 7,189 at Seed, 3,968 at Series A, 2,415 at Series B, 1,574 at Series C and 558 at Series D.
Mail security
Email authentication consists of 3 DNS records that let the world’s mail servers tell your real mail from the spoofers and phishers. SPF lists the servers allowed to send as your domain. DKIM signs each message so a receiver can check it was not altered and came from a sender who holds your key. DMARC tells recipient mail servers what to do with mail that does not seem authentic and who to tell about it.
From a business perspective, companies want to enable all 3 of these to make sure their emails are reaching inboxes and not the spam folder. For one, Google and Yahoo now require DMARC for anyone sending over 5,000 emails per day. There is nothing worse than sending mail to your potential customers only to have it sent to their spam folder because Salesforce or Mailchimp was not configured correctly. While this happens less visibly, someone could also impersonate your domain which could erode your customers’ trust and brand identity. Companies reaching the Series C or D rounds can’t afford either of these outcomes.
From a compliance perspective, almost every framework has a strong opinion about mail security and growing companies have a growing list of assessors to please. NIST is very prescriptive about mail security according to SP 800-177. CIS Controls v8, safeguard 9.5 requires companies to implement DMARC with SPF and DKIM as its prerequisites. PCI DSS v4.0.1 has requirement 5.4.1 for anti-phishing mechanisms. SOC 2 auditors, HIPAA risk assessments and many B2B vendor questionnaires ask about it, and CISA’s BOD 18-01 requires federal agencies to run DMARC at p=reject.
The biggest mistake people make here is to enable enforcement too quickly. You want to enable reporting on everything first before enforcing any policy and let that gather data for 30 to 90 days. During this time, you want to make sure you have good dashboards which can account for all the places your company sends mail from and to, and that they are configured correctly.
Claimable names
A company's technology estate grows as it progresses through the funding rounds. The average Series D company has almost 2x the subdomains that a Series A company does. This is natural since more mature companies have more product lines and use more external SaaS and PaaS over time. Think jira.company.com or github.company.com. The problem happens when you migrate from GitHub to GitLab by deleting the old organization without deleting the DNS record pointing there. Malicious actors can claim your old GitHub org name, and since github.company.com still points there, they now control what your subdomain serves. Thai and Indonesian casino operators are particularly good at taking these subdomains to host content that is otherwise illegal in their country at the expense of your domain’s reputation.
Process and procedure are the keys to preventing these kinds of takeovers which tends to improve with more funding rounds. Change management can enable communication between the teams responsible for decommissioning the resource and the DNS record to make sure they are done together. Security teams can detect if new certificates get registered against old subdomains and take action before the bad content impacts your domain reputation.
Closing
Raising a Series C or D brings more people asking about your security: investors running diligence, enterprise customers sending questionnaires, and assessors asking for evidence. Your mail authentication and subdomains are visible to every one of them from the internet. DMARC in particular takes time to do right, with 30 to 90 days of reporting before you enforce anything, so the time to start is before the raise, not during it.
22 Security's external compliance assessment looks at your company from the internet the way enterprise security reviewers and cyber insurers do, covering mail, DNS and the subdomains you may have forgotten, and maps what it finds to the frameworks your assessors use. If a raise is on the horizon, let us know and we will be happy to scope something out.