What happens if one of your vendors goes down?
Map what a domain DEPENDS ON — every external provider woven into its infrastructure, grouped by function (DNS, mail, email delivery, hosting, physical), with the dependency chains and single-vendor concentration (SPOF) signals.
No credit card needed.
What it solves
An outage or breach at a third-party DNS, mail or hosting provider takes down every customer relying on it, and most organisations don’t have a clear map of which providers their own domain actually depends on for which function. Building that map by hand means checking DNS, SPF, hosting and DKIM records separately and working out by eye which ones are third-party.
It reads each function in turn, the name servers answering for the zone, the mail exchangers and DKIM signers, the senders authorized to send on the domain’s behalf, the networks and CDNs the addresses sit on, and the SaaS platforms subdomains delegate into, keeping only the providers whose own apex differs from the target domain’s, then flags any function that collapses onto a single vendor as a concentration risk.
Mapping third-party dependencies by hand means pulling DNS, SPF, DKIM and hosting records separately and manually sorting which ones are actually external vendors versus self-run infrastructure.
- a DNS record checker
- an SPF/DKIM record parser
- a reverse-IP hosting lookup
- a spreadsheet to group it all by function
What this means
- Give it a domain and it maps every external provider woven into its infrastructure, DNS, mail, email delivery, hosting and physical, that isn’t run by the domain’s own owner.
- It returns each dependency grouped by function with single-vendor concentration flagged, crossing the DNS, email, BGP, WHOIS and physical layers.
Dig deeper
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentationWhy teams run this
The job this flow does, the failure mode it removes, and the proof it produces.
Security leadersRelated flows
All use casesDigital Infrastructure Mapping
Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.
Threat Investigation
The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'
Attack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.