Know which of your domains can be impersonated, and who is accountable for them.
Airports, airlines, operators and suppliers coordinate by email every day. Cirrus Invicta shows you where your domains are exposed and gives your team the ownership, accountability and change control that auditors and NIS2 supply-chain duties ask for.
Built for the sectors NIS2 covers
One forgotten domain can be enough
Transport runs on trust between organisations. A message that appears to come from an operations mailbox can redirect staff, bypass a procedure or announce a policy change that never happened.
Many organisations enforce DMARC on their main domain, yet other domains they own, especially ones that never send mail, are often left with no protection. That makes it much easier for others to send mail that looks like it came from you.
NIS2 also expects you to manage supply-chain cyber risk. That means knowing your domain posture, who owns each domain and when it last changed.
What you get
Protect domains that never send mail
Parked, legacy and defensive domains are easy to forget and easy to spoof. We spot them and show the exact records that lock them down.
Clear ownership and accountability
Every domain has a named owner, a purpose and a record of why it is configured the way it is. Domains nobody owns stand out.
Change control and audit trail
An approved baseline for each domain, alerts when something drifts, and a history of who changed what and when.
Fits your tools
A documented REST API returns structured JSON with a score and recommendations for every control, so results can flow into the systems you already use.
How it works
Scan
Enter a domain. We read its public DNS and report on SPF, DKIM, DMARC, MTA-STS and related controls in seconds.
Assign
Confirm what each domain is for and who owns it. Sending, non-sending, parked or third-party.
Lock down
Follow specific recommendations, then approve the result as your baseline.
Stay in control
Get alerted when a domain drifts from its baseline, with an audit trail for reviewers.
Safe by design
- Assessments use publicly available DNS records. They do not need access to your mailboxes, credentials or message content, and there is nothing to install.
- An Irish company, with personal data handled under EU GDPR.
- Honest about limits: DMARC stops exact-domain spoofing, not lookalike domains or a compromised mailbox.
Questions
Does DMARC stop email impersonation?
No. An enforcing DMARC policy stops other people sending mail that claims to come from your exact domain. It does not stop lookalike domains or a genuinely compromised mailbox. We focus on getting the controllable foundation right, and we are clear about what it does not cover.
Does a scan touch our systems or mail?
No. A domain assessment reads publicly available DNS records, the same information any mail server looks up when it delivers a message to you. It does not need access to your mailboxes, credentials or message content, and there is nothing to install.
Why do domains that never send mail matter?
Organisations often protect their main domain and leave other domains they own, such as old brands, parked or defensive domains, with no email protection at all. That makes it much easier for others to send mail that appears to come from them. The fix is a short set of DNS records that declare the domain sends no mail.
Does this help with NIS2?
NIS2 expects essential and important entities to manage cyber risk across their supply chain. Being able to show which domains you own, who is accountable for each, what their email security looks like and when it last changed is practical evidence for that. It supports your compliance work and does not replace it.
Can we connect it to our own tools?
Yes. Results are available through a REST API as structured JSON, so they can feed your own dashboards, ticketing or risk tools.
See where your domains stand today
Run a free, non-intrusive scan of any domain you own, including the ones that do not send mail.