# v1.9.24 fingerprint expansion candidate triage

Source: 5241-domain full-corpus deep mine (2026-05-26).
Threshold: ≥4 domains for TXT, ≥3 for SPF/MX/NS/rua/cname_target.

Goal: Add every clearly-attributable SaaS / infrastructure provider that the
current catalog misses, so the v2.0 catalog reflects a real reading of the
corpus instead of incremental drift.

Buckets:
- **ADD**: clear vendor, not in catalog. New entry.
- **EXTEND**: vendor present in catalog, missing this detection variant.
- **SKIP**: too generic, ambiguous, government, ccTLD false-positive.
- **SUB**: real but sub-signal of a higher-confidence existing match (e.g. Google rua under google_workspace).

## TXT verifications (114 candidates ≥4 domains)

### High-volume sub-signals (EXTEND existing)

| Pattern | #dom | Action | Maps to |
|---|---|---|---|
| atlassian-sending-domain-verification | 305 | EXTEND atlassian | already covered via existing entries; new TXT detection added |
| google-gws-recovery-domain-verification | 278 | EXTEND google_workspace | |
| work-accounts-domain-verification | 36 | EXTEND google_workspace | |
| smartsheet-gov-site-validation | 24 | EXTEND smartsheet | |
| pexip-portal-domain-verification | 15 | EXTEND pexip | |
| aliyun-site-verification | 13 | EXTEND alibaba | |
| oci-domain-verification | 8 | EXTEND oracle (OCI) | |
| sendinblue-site-verification | 6 | EXTEND brevo | |
| cisco-site-verification | 6 | EXTEND cisco | |
| intercom-domain-validation | 7 | EXTEND intercom | |
| heroku-domain-verification | 15 | EXTEND heroku | |
| github-verification | 9 | EXTEND github | |
| invisionapp-verification | 5 | EXTEND invision | |
| pandadoc-domain-verification | 5 | EXTEND pandadoc | |
| zendeskverification | 4 | EXTEND zendesk | |
| fortinet-fortiphish-site-verification | 4 | EXTEND fortinet | |
| adobe-aem-verification | 4 | EXTEND adobe (or new aem slug) | |
| loom-verification | 20 | EXTEND loom | (already added in v1.9.23, verify) |
| mgverify | 118 | EXTEND mailgun | high-volume Mailgun TXT variant |

### New SaaS, high confidence ADD

| Vendor | Pattern | #dom |
|---|---|---|
| Yahoo SMB | yahoo-verification-key | 176 |
| HashiCorp Cloud Platform | hcp-domain-verification | 138 |
| Astro (web framework) | astro-domain-verification | 62 |
| Remote.com (HR/payroll) | remote-domain-verification | 25 |
| Parsec (remote desktop) | parsec-domain-verification | 22 |
| Zywave (insurance tech) | zywave-domain-verification | 21 |
| Infor CloudSuite | infor-cloudsuite-domain-verification | 16 |
| Proofpoint Wombat | wombat-verification | 15 |
| Parkable | parkable-domain-verification | 15 |
| BetterComp (HR comp) | bettercomp-verify | 15 |
| Gradle Enterprise | gradle-verification | 15 |
| DeepL | deepl-domain-verification | 15 |
| Heyhack (pentest) | heyhack-verification | 15 |
| Make.com (automation) | make-domain-verification | 14 |
| WeWork | wework-site-verification | 14 |
| Airalo (eSIM) | airalo-domain-verification | 14 |
| ProjectDiscovery (security) | projectdiscovery-verification | 14 |
| Dailymotion | dailymotion-domain-verification | 13 |
| Bill One (Japanese billing) | bill-one-domain-verification | 13 |
| Formstack | formstack-domain-verification | 12 |
| AbuseIPDB | abuseipdb-verification | 12 |
| Prowly (PR) | prowly-verification | 12 |
| SolarWinds Service Desk | solarwinds-service0desk-verification | 12 |
| Stytch (auth/identity) | stytch_verification_dns | 11 |
| HeyGen (AI video) | heygen-verification | 11 |
| SafeBreach (security) | safebreach-domain-verification | 11 |
| Brave Browser | brave-ledger-verification | 11 |
| ProdPad | prodpad-domain-verification | 11 |
| Gather (virtual office) | gather-domain-verification | 11 |
| Kiro (AWS IDE) | kiro-site-verification | 10 |
| Nearmap | nearmap-domain-verification | 10 |
| Krisp (AI audio) | krisp-domain-verification | 10 |
| ActiveProspect | activeprospect-domain-verification | 10 |
| Reftab | reftab-domain-verification | 10 |
| Coda | coda-verification | 9 |
| Nulab (Backlog/Cacoo) | nulab-verification-code | 9 |
| Fireflies.ai | fireflies-verification | 9 |
| Virtru (security) | virtru-site-verify | 9 |
| Botify (SEO) | botify-site-verification | 9 |
| Northpass | northpass-domain-verification | 9 |
| WalletConnect | wallet-connect-dns-verification | 8 |
| Barco | barco-verification | 8 |
| Coursera | coursera-domain-verification | 8 |
| Samsung | samsung-domain-verification | 8 |
| Favro (PM) | favro-verification | 8 |
| ContractWorks (Onit) | contractworksverify | 7 |
| IdenTrust (CA) | identrust_validation | 7 |
| DoorDash | doordash-verification | 7 |
| Jumio (identity) | jumio-up-idp-domain-verification | 7 |
| Toast (POS) | toast-domain-verification | 7 |
| Feishu (Lark) | verification-code-site-app_feishu | 7 |
| Ethiack (pentest) | ethiack-verification | 7 |
| ClickUp | clickup-verification | 6 |
| Happeo (intranet) | happeo-site-verification | 6 |
| Spacelift (IaC) | spacelift-domain-verification | 6 |
| Everlytic (email) | everlytic-site-verification | 6 |
| SafetyCulture | safetyculture-domain-verification | 6 |
| Microsec (web3) | microsec-verification | 6 |
| D4Sign (BR e-sign) | d4sign-domain-verification | 5 |
| Razorpay | rzp-site-verification | 5 |
| Specops Software | specops-verification-code | 5 |
| Gitpod | gitpod-verification | 5 |
| Securiti.ai | securiti-verification-id | 5 |
| Trustpilot | trustpilot-one-time-verification-id | 5 |
| QQMail (Tencent) | qqmail-site-verification | 5 |
| NordPass | nordpass-domain-verification | 5 |
| Gem (recruiting) | gem-domain-verification | 5 |
| Arcules (video security) | arcules-domain-verification | 5 |
| Druide (French SaaS) | druide-validation-domaine | 5 |
| eSputnik (email) | esputnik-verification | 5 |
| Freepik | freepik-domain-verification | 5 |
| Lemlist | lemlist-verif | 4 |
| Apperio (legal) | apperio-domain-verification | 4 |
| Read.ai | read-ai-verification | 4 |
| Bird (MessageBird) | bird-domain-verification | 4 |
| DigiCert | digicert-domain-verification | 4 |
| Vitally (CS) | vitally-domain-verification | 4 |
| Sonatype (Nexus) | sonatype-verification | 4 |
| Lucidchart | lucidchart-verification | 4 |

### SKIP (generic / ambiguous / low-confidence attribution)

dtm-domain-verification (160), ps-cd-verification (44), rovag_verification_token (33), access-domain-verification (28), domain-verification (26), domainverification (24), bv-domain-verification (23), verification_token (17), scnv-verification (9), orbitid-domain-verification (7), beam-verification (7), verification (6), opine-verification (4), rm_verify (5), mailer.domain.verification (5), es-domain-verification (4).

## SPF includes (40+ shown, 261 total ≥3 domains)

### High confidence ADD

| Vendor | Pattern | #dom |
|---|---|---|
| Mimecast email security | mim.ec | 58 |
| Oracle Cloud / Oracle EmailDelivery | oraclecloud.com, oracleemaildelivery.com | 49 + 30 |
| PowerSPF (SPF flattener) | powerspf.com | 32 |
| SAP SuccessFactors | successfactors.com, sapsf.eu | 25 + 15 |
| Sailthru (Marigold) | sailthru.com | 23 |
| Emma (email marketing) | e2ma.net | 20 |
| Amadeus (travel) | amadeus.com | 20 |
| Elastic Email | elasticemail.com | 18 |
| Sage Intacct | intacct.com | 16 |
| Constant Contact | constantcontact.com | 16 |
| spf-report (SPF flattener) | spf-report.com | 15 |
| Everbridge | everbridge.net | 15 |
| Q4 Inc (IR services) | q4press.com | 15 |
| Oracle Eloqua | eloqua.com | 14 |
| Tipalti | tipalti.com | 13 |
| MessageProvider | messageprovider.com | 13 |
| MailChannels | mailchannels.net | 13 |
| Braintree (PayPal) | braintreegateway.com | 12 |
| Stibee (Korean email) | stibee.com | 12 |
| Freshservice (Freshworks) | freshservice.com | 11 |
| Ipreo (now IHS) | ipreomail.com | 11 |
| SMTP.com | smtp.com | 11 |

### EXTEND existing

| Pattern | Maps to | #dom |
|---|---|---|
| sendinblue.com | brevo | 24 |
| autospf.email | autospf | 22 |
| zcsend.net | zoho_campaigns or zoho | 20 |
| zoho.com | zoho | 19 |
| qemailserver.com | qualtrics | 18 |
| sdmarc.net | sdmarc or new entry | 16 |
| office365.us | microsoft365 (GCC variant) | 16 |
| secureserver.net | godaddy | 13 |
| dynect.net | dyn / oracle_dyn | 12 |

### SKIP

google.com (28 - already covered), rnmk.com (25 - unclear), sendergen.com (20 - SenderGen, sub-signal), cpmails.com (19 - unclear), md02.com (11 - unclear).

## MX providers (30 shown ≥3 domains)

### ADD

| Vendor | Pattern | #dom |
|---|---|---|
| Mxrecord | mxrecord.mx | 13 |
| CSC Global DNS | cscdns.net | 11 |
| Iberlayer Mailguard | iberlayer.com | 7 |
| Fastmail | messagingengine.com | 5 |
| Yahoo SMB | yahoodns.net | 5 |
| ProtonMail | protonmail.ch | 5 |
| Hornetsecurity | hornetsecurity.com | 4 |
| Tencent QQ Mail Business | qq.com | 4 |
| Appriver/Zix | arsmtp.com | 4 |
| TitanHQ SpamTitan | titanhq.com | 3 |
| Apple iCloud Mail | icloud.com | 3 |

### EXTEND

| Pattern | Maps to | #dom |
|---|---|---|
| smtp.google.com | google_workspace | 92 |
| inbound-smtp.*.amazonaws.com | aws_ses | 17 |
| *.mx.microsoft | microsoft365 | 15 |
| *.msv1.invalid | microsoft365 (null MX placeholder) | 14 |
| *.eo.outlook.com | microsoft365 | 9 |
| fireeyegov.com | fireeye/trellix | 7 |
| fortimailcloud.com | fortinet | 6 |
| cisco.com (IronPort) | cisco | 5 |
| trendmicro.com | trendmicro | 5 |
| alibaba-inc.com | alibaba | 5 |

### SKIP

expediagroup.com (9 - one-off), localhost (7 - misconfig), sgict.gov.sg (7 - gov), usdoj.gov / dren.mil / mail.mil (gov), above.com (parking), h-email.net (unclear), amazon.com (SES variant overlap).

## DMARC rua (30 shown ≥3 domains)

### ADD

| Vendor | Pattern | #dom |
|---|---|---|
| Cloudflare Email Analytics | cloudflare.net | 137 |
| CISA DMARC | dhs.gov | 108 |
| Skout / sdmarc | sdmarc.net | 32 |
| cp-dmarc | cp-dmarc.com | 23 |
| EmailAnalyst | emailanalyst.com | 21 |
| RedSift | redsift.cloud | 18 |
| ReportURI | report-uri.com | 16 |
| DMARC360 | dmarc360.com | 12 |
| MailHardener | mailhardener.com | 11 |
| DMARC25 (Japan) | dmarc25.jp | 10 |
| InboxMonster | inboxmonster.com | 10 |
| DMARCInput | dmarcinput.com | 8 |
| GlockApps | glockapps.com | 7 |

### EXTEND

| Pattern | Maps to | #dom |
|---|---|---|
| rua.dmp.cisco.com | cisco | 30 |
| barracudanetworks.com | barracuda | 13 |
| valigov.email | valimail | 13 |
| brevo.com | brevo | 12 |
| trendmicro.eu | trendmicro | 8 |
| mailgun.org | mailgun | 7 |
| onsecureserver.net | godaddy | 7 |
| alibaba.com | alibaba | 6 |

### SKIP

dmarc.gov.sa (32 - Saudi gov), google.com (9 - sub-signal), mercadolibre.com (8 - one-off), mail.mil/doi.gov/usdoj.gov (gov).

## NS providers (30 shown ≥3 domains)

### ADD

| Vendor | Pattern | #dom |
|---|---|---|
| AT&T DNS | att.net | 27 |
| DNSimple Edge (multi-TLD) | dnsimple-edge.{org,net,com,io} | 14+13+11+11 |
| F5 Cloud DNS | f5clouddns.com | 13 |
| NameBright DNS | namebrightdns.com | 12 |
| Etisalat UAE | etisalatdomains.ae | 11 |
| NetNames | netnames.net | 11 |
| Constellix | constellix.{net,com} | 10 |
| Imperva SecureDNS | impervasecuredns.net | 10 |
| EasyDNS | easydns.org | 9 |
| Com Laude DNS (multi-TLD) | comlaude-dns.{com,net,co.uk,eu} | 9 each |
| Level3 (Lumen) | level3.net | 9 |
| DNSPod (Tencent) | dnsv5.com | 8 |

### EXTEND

| Pattern | Maps to | #dom |
|---|---|---|
| googledomains.com | google_workspace (Google Domains/Squarespace handoff) | 134 |
| oraclecloud.net | oracle | 16 |
| markmonitor.zone | markmonitor | 12 |
| registrar-servers.com | namecheap | 12 |
| gdnsdef.com | godaddy | 10 |

### SKIP

d-53.{jp,info,net} (unclear), ad.jp / ne.jp / co.uk / com.au (ccTLD false positive), es.net (DoE gov).

## cname_target (60 shown ≥3 domains)

### ADD

| Vendor | Pattern | #dom |
|---|---|---|
| WP Engine | wpengine.com | 36 |
| Freshdesk | freshdesk.com | 31 |
| Adobe AEM (CQ) | adobecqms.net | 11 |
| Swoogo (events) | swoogo.com | 10 |
| Cvent Lanyon | lwcal.com | 10 |
| Piano (subscription) | tinypass.com | 10 |
| Validity Everest | everestengagement.com | 9 |
| Edgecast / Verizon Media | edgecastcdn.net | 8 |
| Adestra MessageFocus | msgfocus.com | 7 |
| Gorgias helpdesk | gorgias.help | 7 |
| Shopee | shopeemobile.com | 7 |
| SAP Customer Data Cloud (Gigya) | gigya-api.com | 6 |
| Cleverbridge | cleverbridge.com | 6 |
| Blackbaud Convio | convio.net | 5 |
| Ovative | ovative.com | 5 |
| StackPath / MaxCDN | netdna-cdn.com | 5 |
| ThreatMetrix (LexisNexis) | online-metrix.net | 5 |
| MuleSoft CloudHub | cloudhub.io | 4 |
| BigCommerce | mybigcommerce.com | 4 |
| Rio SEO | rioseo.com | 4 |
| SAP Cloud Platform (Kyma) | ondemand.com | 4 |
| Archbee (docs) | archbee.com | 4 |
| Storm Reply (SAP partner) | stormreply.com | 4 |
| Cloudways | cloudwaysapps.com | 4 |
| BrightSites | mybrightsites.com | 4 |
| Cirrus Identity | cirrusidentity.com | 4 |
| Pressable (managed WP) | pressdns.com | 3 |
| Sanity SVD CDN | svdcdn.com | 3 |
| Mailjet | mailjet.com | 3 |
| INAP | internap.com | 3 |
| Etouches / Aventri | etouches.com | 3 |
| BusinessWire | businesswire.com | 3 |
| Gannett Digital | gannettdigital.com | 3 |
| Sourcepoint CMP | sp-prod.net | 3 |
| Dub (link mgmt) | dub.co | 3 |
| Hund (status) | hund.io | 3 |
| Emarsys (SAP) | emarsys.net | 3 |
| Redocly | redocly.app | 3 |
| Oracle Eloqua | eloqua.com (terminal) | 3 |
| Zoomin Software | zoominsoftware.io | 3 |
| Squarespace | squarespace.com | 3 |

### EXTEND

| Pattern | Maps to | #dom |
|---|---|---|
| netlify.com | netlify (cname_target variant) | 10 |
| outlook.com (hybrid mail) | microsoft365 | 10 |
| herokuspace.com | heroku (custom DNS) | 9 |
| alibabadns.com | alibaba | 6 |
| awsapps.com | aws_workmail / aws | 6 |
| zohohost.com | zoho | 5 |
| alibaba.com | alibaba | 4 |
| pacloudflare.com (China) | cloudflare | 4 |
| desk.com | salesforce | 3 |
| cvent.com | cvent | 3 |
| oracle.com | oracle | 3 |

### SKIP

ogopendata.com (6 - open data portals, not a vendor), nasa.gov (gov), uol.com.br (BR portal one-off), ejoco.com (unclear), sitedetour.com (unclear), onuriscp.com (unclear), ncfp.asia (unclear), marketingautomation.services (ambiguous).

## Summary

| Signal type | ADD | EXTEND | SKIP |
|---|---|---|---|
| TXT | ~77 | ~19 | ~16 |
| SPF | ~22 | ~9 | ~5 |
| MX | ~11 | ~10 | ~9 |
| DMARC rua | ~13 | ~8 | ~6 |
| NS | ~13 | ~5 | ~7 |
| cname_target | ~41 | ~11 | ~8 |
| **Total** | **~177** | **~62** | **~51** |

Target: file under v1.9.24 (mega-batch). No commit until quality gate is green.
