Five Days of Validin, Day 5: Make it a routine you can actually keep

Four commands is four good afternoons. It is not a security program. The last step is making this happen whether or not anyone remembers to do it.

The problem with everything I have written so far

Every nonprofit security effort I have watched fail, failed the same way. Someone motivated set it up. Then that person left, or a grant deadline ate the calendar, and eighteen months later nobody has looked at anything.

The technical work in this series is the easy part. Surviving staff turnover is the hard part, and it is the only part that determines whether any of it mattered.

If you want the argument in one line, go back to Day 2. stony-brook.scrc.symbolics.com is still resolvable thirty-three years after the company that created it went bankrupt. Infrastructure does not tidy itself, and neither do routines.

Check your budget any time

curl -s -H "Authorization: Bearer $VALIDIN_KEY" "https://app.validin.com/api/profile/usage"

Real response:

{
  "usage": {
    "/api/axon/domain/certificates/:domain": {"daily": 1, "monthly": 1},
    "/api/axon/domain/subdomains/:domain": {"daily": 1, "monthly": 2},
    "/api/axon/domain/dns/extra/:domain": {"daily": 5, "monthly": 6}
  },
  "remaining": {
    "daily": 2,
    "monthly": 31,
    "next_daily_reset": 1786406400,
    "next_monthly_reset": 1788220800
  }
}

This does not count against your quota, so check it freely. Usage is broken out per endpoint, so you can see exactly where your queries went.

The reset fields are Unix timestamps. Converting one depends on which date you have. On macOS, date -r 1786406400. On Linux, including WSL, date -d @1786406400, because GNU date reads -r as “the modification time of this file” and will tell you there is no such file. Add -u to either to read it in UTC, which is what the resets are keyed to.

One thing worth knowing: a query costs the same whether you ask for 10 results or 250. Always ask for 250. A truncated result you have to re-run costs a second query.

The monthly routine

Fifty queries a month. This routine uses six and takes about twenty minutes.

Every month, three commands against your own domain.

Day 1, DNS history. Looking for addresses and nameservers you did not authorize.

Day 2, subdomains and certificates. Looking for names that appeared since last month, and anything expiring inside 30 days.

The monthly question is not “is this correct.” It is “what changed.” That is a much faster read, and it is why saving last month’s output matters more than reading this month’s carefully.

Every quarter, one more.

Day 3, email authentication. Confirming SPF, DMARC, and CAA are still what you set them to. These break quietly during vendor migrations, and a broken SPF record is invisible until deliverability drops.

Keep the rest in reserve. Roughly 40 queries a month stay unspent, and that is deliberate. It is your budget for Day 4 triage when somebody forwards a suspicious email, and that is the one query you cannot schedule.

Making it survive you

This is the part that actually matters.

Write it down where the organization keeps things, not where you keep things. A page in your shared drive or wiki, titled something a stranger would search for. Not a note on your laptop.

Paste the actual commands in, with your domain already filled in. Not a link to this blog. Every layer of indirection is a place where the next person gives up.

Include what a normal result looks like. Save this month’s output alongside the commands. Whoever runs this after you has no idea what normal looks like, and without a baseline the output is meaningless to them.

Put it in a recurring calendar invite. Monthly, twenty minutes, with the link in the invite body.

Invite two people. This is the highest-value line in this post. A task owned by one person ends when that person does. Two people means somebody notices when it stops happening.

Record where the API key lives and when it expires. Keys last at most 180 days. Write the expiry date on the page. A routine that silently stopped working four months ago is worse than no routine, because it produces false confidence.

What this gets you

Four commands, on a schedule, on a free account, at an organization with no security staff.

You will know when your DNS changes. When a new subdomain appears. When a certificate is issued in your name or is about to expire. Whether your email can be forged. And you will have a fast, defensible answer when a staff member asks whether a link is safe.

That is not a security program. It is a baseline, and it is dramatically more than most organizations your size have. It costs nothing but the twenty minutes.

Where to go from here

Inside Validin, there is more than this series covers. If your website is well known enough to have been crawled, the platform will show you the fingerprints your server leaves in every response, and let you search the internet for other hosts sharing them. That is how cloned donation pages get found.

I left it out of this series deliberately. It depends on your site being in the crawl dataset, and when I tested against a modest site it returned nothing at all. If your organization has a large public footprint, it is worth exploring. If not, do not spend an afternoon on an empty result.

The paid tiers add lookalike domain search, WHOIS history, saved projects, and alerting. For most small nonprofits the free tier plus this routine is the right stopping point.

Outside Validin, the honest next steps in rough order of value:

Multi-factor authentication everywhere, especially email and your donation platform. Nothing in this series matters as much as this one.

A verbal verification rule for any payment or banking change, from a number you already had.

Offline, tested backups. Tested is the operative word.

Then, and only then, the kind of external assessment I do for a living.

I put this series together because the tooling gap for under-resourced organizations is smaller than most people think, and a lot of what a consultant does in the first week is available to anyone with a free account and twenty minutes a month.

If your organization wants help turning this into something more durable, my inbox is open.

That is the series. Thanks for following along.