Domain and DNS
Takeover of dangling addresses, CAA, DNSSEC, security.txt, SPF lookups and MTA-STS.
What we check
Besides email protection, we read public DNS records of your domain and the file /.well-known/security.txt, which is meant for security reports. Whether the domain is signed with DNSSEC we ask through DNS-over-HTTPS at Cloudflare. On platform addresses such as xyz.lovable.app we skip CAA, DNSSEC and email, those belong to the platform.
CAA, DNSSEC, security.txt and MTA-STS are notices and don't affect the grade; many large sites lack them too. An address strangers can take over costs as much as an exposed key, and an SPF record with too many lookups as much as a missing one.
Dangling CNAME (address takeover)
If your address points via CNAME to a service such as GitHub Pages, Heroku, Amazon S3 or Shopify and the target no longer exists there, someone else can create it. They can then serve their own content under your address, for example a phishing page. We only report this when the service shows its distinctive error page, and then as a critical finding.
How to fix it: Delete the CNAME record at your domain provider if you no longer use the service, or create the target there again.
Who may issue certificates (CAA)
Without a CAA record, any certificate authority may issue a certificate for your domain. The record restricts this to the authorities you use.
company.com. CAA 0 issue "letsencrypt.org"
company.com. CAA 0 iodef "mailto:security@company.com"DNSSEC
DNSSEC signs the answers of your name server so they cannot be forged on the way. The German Federal Office for Information Security (BSI) recommends it. At most domain providers it is a switch in the domain settings.
Contact for security reports (security.txt)
The file /.well-known/security.txt (RFC 9116) tells security researchers where to report a vulnerability they found. For NIS2 entities and manufacturers under the Cyber Resilience Act, a defined reporting channel is required anyway.
Contact: mailto:security@company.com
Expires: 2027-10-31T00:00:00.000Z
Preferred-Languages: en, deSPF with too many DNS lookups
An SPF record may trigger at most 10 DNS lookups during evaluation (RFC 7208), counting include, a, mx, ptr, exists and redirect, including nested records. Above that, many mailboxes treat the record as an error. Remove services that no longer send in your name or merge records.
Encrypted delivery to your company (MTA-STS)
Mail servers only encrypt between each other when both sides offer it. An attacker on the network can suppress the offer and read email sent to your company. MTA-STS or DANE make sure mail is only delivered encrypted. We only show this notice if your domain receives email (MX record) and both are missing.
_mta-sts.company.com. TXT "v=STSv1; id=20261026"
# https://mta-sts.company.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: company-com.mail.protection.outlook.com
max_age: 604800Still have questions? Email us.