How Safe Is Your Domain?
summary
Survey of 929 top domains finds zero following all domain best practices; only 5% enable DNSSEC, 25% use multiple DNS providers, 68% publish SPF and 58% publish DMARC, 0.2% have TLSA and 1.5% have MTA-STS, 8% serve security.txt and 25% publish CAA. Advice focuses on registrar protections (2FA, IP restrictions, server/client locks), mail DNS records, and name-server diversity. A public scanner at domainlabs.com is demonstrated to score domains and list registrars that support server locks.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:19Basic DNS Threat model
- 5:07Nameserver Safety
- 7:58Registrar Protection
- 11:05Name Server Safety
- 12:15DNS Records for Mail
related talks
40mWebsite security 101
47mHow to Detect Your Domains Being Abused for Phishing Using DNS
44mSecurely Sending Email in 2024
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
44mModern Email Security
27mA Longitudinal, End-to-End View of the DNSSEC Ecosystem
22mNot that Simple: Email Delivery in the 21st Century
13mA Positive Security Talk