Security Research

At SH Consulting, our mission goes beyond protecting individual clients - we work to strengthen the entire email ecosystem. Our security research team operates continuously to uncover critical vulnerabilities in mail servers, DNS infrastructure, and authentication protocols that are frequently exploited by threat actors.
We investigate how these weaknesses are being abused, assess the potential impact, and assist organizations - from startups to global enterprises - in closing the gaps before they are used against them.

Research Focus Areas

While our primary focus is on technology companies, we also conduct in-depth research and vulnerability audits across:

E-commerce platforms

Financial institutions

Government agencies

Non-profits

Real estate firms

Small to medium size enterprises (SMB companies)

System integrators and consultancies that serve enterprises and governments

Technology startups and scale-ups

Our Research Includes Vulnerabilities In

SH Consulting is a responsible actor and trusted participant in the email security community. In most cases, we mitigate the discovered issue before reporting it, ensuring it is not exploited in the wild.

Email authentication protocols (SPF, DKIM, DMARC)

DNS misconfigurations (e.g., CNAME dangling, missing CAA records)

TLS/SSL issues, including downgrade vulnerabilities and misissuance

Email server misconfiguration & open relays

Website attack surfaces related to email intake or user data forms

Key Insights From Our Research

These findings underscore the urgency of closing configuration gaps across industries.

35%

of small businesses (under 50 employees) experience continuous email-based attacks due to poor authentication setup or lack of enforcement.

0.5%

Among 50,000 audited companies, 250 companies had high-impact vulnerabilities that could be exploited by attackers with only a basic understanding of DNS and email protocols - no sophisticated tools required.

Industry Collaboration

SH Consulting works closely with major email security vendors and DNS service providers to enforce emerging security standards, support coordinated disclosures, and advocate for a safer digital communication environment.
‍
Make email more secure for everyone.

We continuously track updates in protocol specifications, such as DMARC extensions, MTA-STS best practices, and DNSSEC deployment models, aligning our tools and guidance with evolving global standards.