# SH Consulting

> Email deliverability consulting — inbox placement, deliverability audits, blacklist remediation, sender reputation recovery, and DMARC/SPF/DKIM authentication. We ensure legitimate emails reach the inbox and protect organizations from spoofing and phishing.

## About

SH Consulting is a specialized email security and deliverability consulting firm serving 450+ organizations across the US, Canada, and EU — with deep expertise in real estate technology (CRM/IDX platforms), SaaS, and e-commerce. Founded by Alex Shakhov, a security researcher with 10+ years in email deliverability and DNS security whose work has been covered by Ars Technica, EdScoop, and Risky Business. The team includes former SendGrid Head of Deliverability Luke Martinez, who managed infrastructure for 20 billion monthly emails for platforms including Uber, Booking.com, and Spotify. Headquartered in Warsaw, Poland, with a distributed team across the EU and US, supporting both North American clients and EU NIS2 compliance requirements.

## Services

- [Email Security](https://www.sh.consulting/services/email-security): DMARC enforcement, SPF/DKIM/BIMI implementation, domain spoofing protection, phishing defense, MTA-STS/TLS-RPT deployment, business email compromise investigation, and incident response.
- [Email Deliverability](https://www.sh.consulting/services/email-deliverability): Full-stack deliverability audits, blacklist remediation, sender reputation recovery, ESP migration, IP/domain warm-up strategies, inbox placement optimization, and ongoing monitoring.
- [Security Research](https://www.sh.consulting/services/security-research): Continuous vulnerability research across email servers, DNS infrastructure, and authentication protocols. Discovery and responsible disclosure of threats before exploitation.
- [System Consolidation](https://www.sh.consulting/services/system-consolidation): Consolidation of multiple ESPs, legacy MTAs, and fragmented email tools into unified, cost-effective systems.

## Platform & Capabilities

- Internal DMARC analytics system monitoring DMARC aggregate reports across 1,300+ domains for 900+ companies
- Security vulnerability assessment program that identifies email and DNS vulnerabilities in organizations before scammers can exploit them

## Free Tools & Resources

- [dmarc.cc](https://dmarc.cc): Free bulk DMARC checker — analyze email authentication records across many domains at once.
- [deliverability.guide](https://deliverability.guide): Free Email Deliverability Guide — 15 essential rules covering authentication, sender reputation, list hygiene, monitoring, and infrastructure.

## Notable Research

- [Hazy Hawk .edu subdomain takeovers](https://www.sh.consulting/blog/hazy-hawk-hijacked-subdomains-mit-harvard-stanford-us-universities): Discovered a coordinated subdomain hijacking campaign affecting 34 US universities including MIT, Harvard, Stanford, UC Berkeley, and Columbia — hundreds of hijacked .edu subdomains serving scam content indexed by Google.
- Discovered an unregistered domain in Cloudflare's official DMARC documentation that silently collected infrastructure data from dozens of organizations
- Documented Microsoft 365 Groups bypassing DMARC enforcement, allowing spoofed emails through despite p=reject policies
- Exposed a compromised SendGrid API key responsible for 2.3 million unauthorized emails and a $10,000 bill
- Identified architectural flaws in SaaS platforms enabling phishing through trusted email infrastructure
- Documented GoDaddy enforced DMARC policies creating security and privacy risks for domain owners

## Media Coverage

- [Ars Technica: Why are top university websites serving porn? It comes down to shoddy housekeeping](https://arstechnica.com/security/2026/04/why-are-top-university-websites-serving-porn-it-comes-down-to-shoddy-housekeeping/)
- [EdScoop: Threat actor hijacked subdomains at 30+ major universities, researcher found](https://edscoop.com/threat-actor-hijacked-subdomains-at-30-major-universities-researcher-found/)
- [Risky Business: Risky Bulletin coverage of the .edu subdomain hijacking research](https://risky.biz/risky-bulletin-nist-gives-up-enriching-most-cves/)
- [The Daily (University of Washington): Report reveals UW subdomains linked to pornographic content](https://www.dailyuw.com/article/report-reveals-uw-subdomains-linked-to-pornographic-content-in-hundreds-of-search-results-20260430)
- [GÉANT Security (European research network)](https://security.geant.org/threat-actor-hijacked-subdomains-at-30-major-universities-researcher-found/)
- [Habr (Russian)](https://habr.com/ru/news/1030204/)
- [Red Hot Cyber (Italian)](https://www.redhotcyber.com/post/harvard-insegna-e-gli-hacker-fanno-pubblicazioni-benvenuti-nel-seo-estremo/)
- [IT Home (Chinese)](https://www.ithome.com/0/943/706.htm)
- Also cited by journalist Kim Zetter and independently corroborated by university IT security teams

## Partnerships

- Mailchimp partner agency
- Klaviyo Partner (K:Partners Agency Program)

## Reviews

- [Clutch profile](https://clutch.co/profile/sh-consulting-0): Verified client reviews
- [Agency partner directory profile](https://customer.io/agency-partners/partner/sh-consulting): Partner directory listing with client reviews

## Expertise

- Email authentication protocols: SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DNSSEC
- Email service providers: Google Workspace, Microsoft 365, SendGrid, Mailchimp, Klaviyo, Amazon SES, Mailgun, and others
- Real estate technology stack: Follow Up Boss, Sierra Interactive, Ylopo, BombBomb, and IDX/CRM email infrastructure
- Deliverability monitoring: Google Postmaster Tools, Microsoft SNDS, Yahoo Postmaster, feedback loops, DMARC aggregate and forensic reports, Snowflake data warehouse
- Direct relationships with deliverability and abuse teams at Google, Microsoft, Yahoo, and major RBL/DNSBL operators
- 450+ organizations served — clients include BombBomb, Ylopo, Sierra Interactive, TripleSeat, Nimble, Curaytor, LoLo Gifts, OneLine

## Contact

- Website: https://www.sh.consulting
- Email: hello@sh.consulting
- Book a call: https://www.sh-calendar.com
- Company LinkedIn: https://www.linkedin.com/company/shdotconsulting/
- Founder — Alex Shakhov: https://www.linkedin.com/in/alexshakhov/