Part 11 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read the previous part, Commune data breach: one community platform, 29 organizations exposed.

TL;DR: A company’s DNS and email-authentication records are public by design, and Japan’s privacy law does not stop anyone from reading or discussing them. What keeps people quiet is fear: of hacking charges, of defamation, and of looking like a sales pitch. Attackers worry about none of those things. So the one party that reliably doesn’t know about a company’s weaknesses is the company itself. The fix is to read your own public signals before someone else does.

The thing I thought I couldn’t say

For years I carried a vague belief that Japanese privacy law kept me from talking about what I could see in a company’s public records. I couldn’t tell you where it came from. When I finally checked, it turned out to be wrong, and the real situation is stranger and worse.

Every company with a domain publishes records that tell the internet how its email and website should work. Its DNS lists which servers handle its mail, which services may send email on its behalf, and whether forged messages should be rejected. Anyone can look these up in seconds, and anyone who knows what they’re reading can tell a lot about how carefully a company runs its technology. I check them routinely in my own work, and I regularly find missing or broken email authentication at companies that would be horrified to hear it.

Japan’s personal information law, the APPI, protects information about living individuals. The government’s own explainer defines personal information as information about a living person that can identify them. A company’s mail server settings are nothing of the kind. Nothing in the privacy law stops me, an IT provider, or a curious customer from reading a company’s DNS or saying what it shows.

So why does nobody say anything?

Because the law people actually fear is a different one. In 2005 the Tokyo District Court gave a former Kyoto University researcher an eight-month suspended sentence under the Unauthorized Access Act. He had used a flaw in the website of ACCS, a software copyright association, to pull personal data, then presented the method at a security event without telling ACCS for three months. He went well beyond reading public records, and the court said so. But his lawyer’s warning after the verdict has aged well: if people stop pointing out vulnerabilities, servers stay vulnerable, and ordinary users pay for it.

Then there was Coinhive. A web designer ran a cryptocurrency-mining script on his music site in 2017 and was prosecuted for storing an illicit program. He was acquitted, fined on appeal, and finally cleared by the Supreme Court in January 2022. Afterward he said he had long doubted where the line for a crime was being drawn, and that the ruling “will save many technicians.” Cases like these taught Japan’s technical community that the line between curiosity and a criminal case is blurry, and that the safe move is to stay well away from it.

The official disclosure system reinforces the habit. Under the early-warning partnership run by IPA, the Information-technology Promotion Agency, someone who finds a website vulnerability reports it to IPA, which contacts the site operator privately. In September 2025, the Ministry of Economy, Trade and Industry, IPA, JPCERT/CC, and the National Cybersecurity Office jointly asked finders not to disclose vulnerability information to third parties without a legitimate reason, and asked the media to refrain from spreading it through reporting or social media. Private disclosure of real, exploitable flaws makes sense. A missing email-authentication record is arguably not even a vulnerability in that system’s sense. But the message that reaches most people is simple: keep quiet.

Then add the ordinary social risks. Publicly naming a company as insecure invites defamation and business-interference complaints. Privately warning a stranger looks like a sales pitch at best and a threat at worst. An IT provider who spots a prospect’s broken email setup has every commercial reason to say something, and every social reason not to.

The only people acting are the wrong ones

The result is perfectly backwards. The information is public. Most people who could read it never do. The professionals who do read it, and could help, mostly stay silent. The one group with no reason to hold back is attackers, who aren’t worried about a defamation claim, a court case, or seeming rude.

And attackers do read it. When JPCERT/CC, the Japan Computer Emergency Response Team Coordination Center, warned about this autumn’s wave of intrusions in Japan, the first attack pattern it described was attackers scanning targets for known vulnerabilities and exposed files. Reconnaissance is cheap, automated, and continuous. As I argued in Blood in the water, the neglected basics anyone can check from the outside tell an attacker which companies are probably neglecting the parts nobody can see.

The gap is not small. Proofpoint, an email-security company, found that 92 percent of Nikkei 225 companies had a DMARC record in July 2026, but only 43 percent enforced it. If Japan’s largest companies leave that door half open, smaller ones without an IT department are rarely doing better, and almost nobody is telling them.

Silence protects the wrong people

Keeping quiet is supposed to spare companies embarrassment and keep attackers from learning about flaws. Here it does neither. Attackers already have the information, because it’s public and they look. The only party that doesn’t know is the company. The silence doesn’t hide the weakness from attackers. It hides it from the people who would fix it.

This is the same false confidence that runs through Japan’s breach wave. Companies assume that because nobody has said anything, nothing is wrong. But nobody was ever going to say anything. As with vendors, handing the work to someone else doesn’t hand over the responsibility, and leaving the looking to nobody doesn’t either.

Read your own records first

There is one party with no legal, social, or commercial barrier at all: the company itself. Reading your own public records is free, legal, and fast. You don’t need to wait for an outsider to find the nerve to tell you.

Start with what the outside world already sees: whether your domain has SPF, DKIM, and an enforcing DMARC policy; whether your website platform and plugins are current; whether admin login pages are exposed to the internet; and who actually controls your domain and DNS accounts. For a quick read, the Domain Exposure Check gives you a free outline, with a full report for ¥5,000 + tax. For a complete review, the external exposure check in Diagnostics covers up to three domains using the same view any customer, partner, or stranger already has, and involves no testing of your systems.

Sources