# Cirrus Invicta — Complete LLM Context

> Cirrus Invicta is an email security governance and accountability platform that helps organisations achieve and verify DMARC enforcement, manage email security controls, and meet regulatory standards like NIS2.

This document compiles the full technical specifications, domain security audit parameters, product capabilities, and full texts of legal and privacy policies.

---

## 1. Product Capabilities & Governance Model

Cirrus Invicta bridges the gap between raw email security data and accountability. Traditional email security tools focus on visibility; Cirrus Invicta focuses on governance and compliance evidence:

- **Accountability & Approvals:** Tracks who authorized an SPF/DKIM change or DMARC enforcement level (`none` -> `quarantine` -> `reject`), documenting compliance over time for audit purposes.
- **NIS2 & CyFun Alignment:** Built explicitly to address accountability requirements under European NIS2 (Network and Information Security Directive), CyFun framework, ISO 27001, and SOC2, demonstrating that key email controls have been continuously monitored and verified.
- **MSPs & Client Boundaries:** Provides clear delineation of security responsibility between Managed Service Providers (MSPs) and their SME clients to prevent liability drift.
- **Drift Detection:** Continuously monitors for unauthorized modifications to SPF, DKIM, DMARC, or MX configurations.

---

## 2. Domain Security Audit Tool Specifications

The free Domain Security Audit tool (available on our homepage) analyzes a domain's public DNS and routing setup to produce an overall security compliance score.

### Check Categories

#### A. DMARC (Spoofing Protection)
- **Presence Check:** Queries the TXT record at `_dmarc.{domain}`.
- **Policy Level Evaluation:** Evaluates the `p=` tag. Policy levels include:
  - `p=reject` (Full protection - unauthorized emails are blocked).
  - `p=quarantine` (Partial protection - unauthorized emails are sent to spam).
  - `p=none` (Monitoring only - no active protection).
- **Syntax Validation:** Checks for common formatting issues and configuration warnings.

#### B. Email Authentication (SPF & DKIM)
- **SPF (Sender Policy Framework):** Queries `domain` TXT records starting with `v=spf1`. Validates mechanism formatting and qualifiers (e.g., `-all` hard fail vs. `~all` soft fail vs. `?all` neutral).
- **DKIM (DomainKeys Identified Mail):** Performs selector subtree verification checks to detect active cryptographic signing configurations.

#### C. Mail Delivery (MX Records)
- Queries MX records, verifying priority preferences, hostname configurations, IPv6 capabilities, and corresponding A records.
- Detects the use of "Null MX" records (which block inbound mail delivery).

#### D. Secure Delivery Controls
- **MTA-STS:** Confirms if Strict Transport Security is enabled to enforce TLS on inbound mail.
- **DNSSEC:** Checks for cryptographic integrity checks on domain records.
- **TLS-RPT:** Verifies if TLS reporting records are set up.
- **CAA:** Verifies if Certification Authority Authorization is configured.

---

## 3. The Cirrus Invicta Journal

The Cirrus Invicta Journal (https://news.cirrusinvicta.com/) serves as our public repository of insights. Key content pillars include:
- **Founder & Startup Logs:** Documenting the development journey, including milestones like acceptance onto Enterprise Ireland's New Frontiers accelerator programme.
- **DevOps & Software Architecture:** Technical articles covering modern infrastructure setups (e.g., configuring ephemeral test environments with GitLab and IBM Cloud Code Engine).
- **Domain Security Findings:** Real-world analyses of email security trends gathered from audit scans (e.g., initial audit data revealing that only 30% of scanned domains have adequate DMARC protection).

---