Passive DNS Telemetry (RFC 7489 / RFC 7208) • Canadian B2B Security Desk

Verifiable DMARC & Email-Spoofing Remediation Leads for MSPs

SecurBroker Intelligence (operated by Kloud, Canada) performs non-intrusive DNS-over-HTTPS audits to identify mid-market organizations lacking DMARC enforcement, cross-verifies IT leadership contacts via live MX & OSINT APIs, and assigns each dossier to a single Managed Service Provider.

Test Live DNS Scanner Below Request a Free First-Lead Sample

Verify Our Telemetry Live: Interactive DMARC & SPF Inspector

Don't take marketing claims on faith. Enter any corporate domain below to run a live passive query against Google Public DNS-over-HTTPS (dns.google/resolve) and inspect its exact DMARC (_dmarc) and SPF posture in real time.

Click "Run Live DoH Audit" to query live DNS TXT records...

What You Receive: Exact Lead Dossier Specification

Every $75.00 lead dossier is delivered via JSON webhook or DKIM-signed email. Below is an actual redacted production payload from our fulfillment engine.

{
  "lead_id": "lead_[REDACTED]",
  "target_domain": "[REDACTED-ENTERPRISE-DOMAIN].com",
  "vulnerability_analysis": {
    "classification": "CRITICAL_MISSING_DMARC",
    "dmarc_record_found": null,
    "dmarc_policy": "MISSING (Open to Executive Domain Spoofing / BEC)",
    "spf_permissive": false,
    "rfc_reference": "IETF RFC 7489 Section 6.6.3",
    "recommended_msp_action": "Deploy SPF alignment, DKIM signing, and DMARC p=quarantine/reject enforcement."
  },
  "contact_details": {
    "name": "[REDACTED — Unlocked in Full Dossier]",
    "title": "Director of IT / Operations",
    "email": "[REDACTED]@[REDACTED-ENTERPRISE-DOMAIN].com",
    "mx_server_verified": true,
    "verification_source": "OSINT_DIRECTORY_API + GOOGLE_DOH_MX",
    "status": "VERIFIED_DELIVERABLE"
  },
  "exclusivity_lock": {
    "single_buyer_assignment": true,
    "assigned_partner_id": "partner_[REDACTED]",
    "settlement_rail": "AWS EventBridge Partner Bus (Stripe)"
  }
}

How "Verified Contact" Works (No Guesswork) We query commercial B2B domain directories and cross-check the target domain's active Mail Exchange (MX) records via Google DoH before a lead is ever queued. If a contact email hard-bounces within 14 days, we replace the dossier 1-for-1 or issue a full Stripe refund.
How Single-Buyer Exclusivity is Enforced In our transactional ledger, each discovered domain transitions from NEW → INVOICED → SOLD with a foreign-key lock to a single partner_id. Once assigned, the domain is excluded from future partner distribution.
Free First-Lead Verification for New MSP Partners Because we are an early-stage specialized telemetry provider, any prospective MSP can request one unlocked sample dossier in their geographic territory at $0 cost to validate our data quality before purchasing.

Technical Standards, Compliance & Infrastructure

Transparent engineering architecture—no inflated claims or fabricated certifications.

100% Passive OSINT (Zero Intrusion)

Our scanner performs strictly passive public DNS queries over HTTPS (IETF RFC 8484) evaluating RFC 7489 (DMARC) and RFC 7208 (SPF) records. We never perform port scanning, vulnerability exploitation, or authenticated probing against target networks.

PCI-DSS Level 1 Payment Processing via Stripe

All invoicing and settlements are processed directly on Stripe-hosted Checkout pages settled via AWS EventBridge. SecurBroker Intelligence never collects, processes, or stores credit card or ACH banking credentials.

CASL & CAN-SPAM Compliant B2B Delivery

All outbound partner notifications are cryptographically signed with DKIM & SPF on kloud.ca via AWS Simple Email Service, include clear sender identification, and honor immediate 1-click unsubscribe requests.