The list — Domain Security Practitioner

The not-doing section is written at the same time as the plan and for the same audience. Each entry names what it would have addressed, why it is not proportionate here, and the trigger to revisit.

For this estate

Not doing	Would have addressed	Why not	Revisit if
DNSSEC on `calderandvoss.com`	Record tampering; prerequisite for DANE	The one signed domain in this estate has been failing validation for an unknown period and nobody detected it. Adding a second is adding a second outage nobody will see.	The provider offers managed signing with CDS, and signature-expiry monitoring is live
DANE	On-path interception of inbound mail	Requires DNSSEC, which is deferred, and the MX zone would need signing too	DNSSEC is deployed and boring for two quarters
BIMI	Nothing defensive — brand recognition in the inbox	No registered trademark, and an annual certificate cost with no security benefit	A trademark is registered for another reason and marketing wants it
Registry lock beyond two domains	Domain hijack surviving full registrar-account compromise	Per-domain fee and real change friction across eleven domains	A third domain becomes business-critical
Defensive registration beyond the primary brand	A fraction of the lookalike space	The space is unbounded; monitoring covers all of it for less	A specific permutation is used against us twice
A commercial brand monitoring service	Faster and broader lookalike detection	Nobody is resourced to work a queue yet. Start with CT and registration feeds into the existing security queue.	The internal queue is being worked and is the constraint

What is not on this list

Nothing free is on it.

Registrar MFA, rua everywhere, the non-sending record
set, removing dangling records, CAA, np=reject,
DMARC to at least quarantine on sending domains.

A not-doing entry for any of those is an error in the
report, not a judgement call.

Write it before you need it

Written alongside the plan, this is a set of decisions with reasons. Written after an incident, it is an explanation — and it will read as one however true it is. The revisit triggers are what make the difference: they show the question was asked and answered rather than never considered.

Knowledge check

Which of these would be an error to put on a not-doing list rather than a judgement call?

Removing the dangling CNAME — a dangling delegation is a standing takeover opportunity and costs nothing to fix.
DNSSEC on the primary domain.
BIMI.
Registry lock beyond the two critical domains.

Correct — Removing the dangling CNAME — a dangling delegation is a standing takeover opportunity and costs nothing to fix. Nothing free belongs on the list: registrar MFA, rua everywhere, the non-sending set, CAA, np=reject and DMARC to at least quarantine. Deferring DNSSEC, DANE, BIMI or registry lock are all defensible.

Not this — DNSSEC on the primary domain. Defensible here specifically — the one signed domain in the estate has been silently failing validation, which is evidence the team cannot yet operate it.

Not this — BIMI. It has no defensive property and requires a trademark this organisation does not have.

Not this — Registry lock beyond the two critical domains. A per-domain fee and real change friction. Scoping it is exactly the kind of judgement the list is for.