Knowledge base
How the standards we check work, what each scanner finding means, and how to fix it on your own domain.
22 articles in 7 topics
Dns security
3 articles-
Zone Walking Through DNSSEC NSEC Chain Enumeration
DNSSEC zone walking lets an attacker follow the NSEC chain to list every hostname in your zone; switch to NSEC3 and monitor for walks.
-
DNSSEC Stripping: How Man-in-the-Middle Attacks Disable DNSSEC Protection
A DNSSEC stripping attack removes RRSIG records in transit so resolvers fall back to insecure answers; learn how to detect and block it.
-
DNSSEC: The Invisible Shield Protecting Your Domain's Integrity
See how DNSSEC prevents DNS spoofing: signed records and a chain of trust let resolvers reject forged answers before users reach a fake site.
Email security
6 articles-
Cert Rotated, TLSA Forgotten: The Mail Outage Caused by Stale DANE-EE Records
Stale TLSA records after a certificate renewal cause a mail outage; update the DANE-EE hash and rotate keys safely with a pre-publish step.
-
The BIMI Bypass: Displaying a Fake Brand Logo Without a VMC
Fake domain, real-looking logo: see how attackers abuse BIMI without a VMC, tricking mail clients into rendering unverified brand logos in inbox.
-
DMARC Alignment Bypass: When SPF/DKIM Domains Don't Match Your From Header
Fix a DMARC alignment failure when SPF and DKIM authenticate a different domain than your From header: audit senders, then move to p=reject.
-
Silent Failures in DANE: Why Softfail Configuration Enables Mail Interception
A DANE softfail configuration lets Postfix deliver mail even when TLSA validation fails; switch to mandatory DANE and verify with posttls-finger.
-
DMARC p=none Trap: Why 'Monitor-Only' Policies Enable Email Spoofing
With DMARC p=none, email spoofing of your domain goes unblocked; fix SPF and DKIM alignment, then move to quarantine and reject.
-
Why Your DANE Certificate Migration Failed: Common TLSA Update Mistakes
If your DANE certificate migration failed, a TLSA record still pinned to the old key is the likely cause; publish the new hash first.
Email security & authentication
1 articleFindings
4 articles-
Fixing session cookies that lack a __Host- or __Secure- prefix
Fix session cookies missing a __Host- or __Secure- prefix. Block cookie tossing and downgrade overwrites, with Flask, Express, PHP configs.
-
Fixing mixed active content on HTTPS pages by upgrading subresources
Fix mixed active content on HTTPS pages: find http:// scripts, styles and iframes, upgrade them to HTTPS, and confirm the finding clears on rescan.
-
How to fix a missing DS record at the parent zone
Fix a missing DS record at the parent zone: get DS data from your signed zone, submit it at your registrar, then verify with dig and delv.
-
IRR route object missing or naming a different origin
Fix IRR route object missing or naming a different origin: compare RPKI, BGP and IRR data, delete stale objects, register the right origin.
Network security
1 articleStandards
4 articles-
Dead Man's ROA: Outages Caused by Expired ROAs and Stale Manifests in a Self-Hosted CA
Self-hosted RPKI CA outages: expired manifests, CRLs and ROAs make ROV networks drop your prefixes. Learn how to monitor and prevent them.
-
CAA Wildcard Gap: Why *.example.com Ignores the Base Domain's CA Restriction
Wildcard cert issued from unauthorized CA? Learn why *.example.com skips base domain's CAA issue restriction when issuewild tag missing; close gap now.
-
Route Hijacking Through Expired ROA Windows: The Cost of Forgotten Validations
See what happens when a ROA expires: the prefix drops to not found, hijackers can announce it, and expiry alerts plus auto-renewal close the gap.
-
The Maxlength Trap: How Generous ROA Scoping Enables Prefix Hijacking
A generous ROA maxlength enables prefix hijacking by letting forged subprefixes validate; set maxLength to the announced length and monitor it.
Web security
3 articles-
Phantom Disclosure: When security.txt Points to a Dead Mailbox
A security.txt dead mailbox silently swallows vulnerability reports; check that the Contact address receives mail and set a short Expires date.
-
Expired TLS Certificates: Why Your HTTPS Lock Becomes a Liability
An expired TLS certificate risks man-in-the-middle interception when clients skip validation; automate renewal and enforce strict checks in code.
-
SSL Stripping Attacks: When Missing HSTS Headers Leave Domains Vulnerable
An SSL stripping attack downgrades HTTPS to HTTP on the first visit, so set an HSTS header with a long max-age and preload the domain.
No articles match that search
Try a standard name like SPF or DNSSEC, or the finding code shown next to a failed check in your scan results.
See where your domain stands
Run a free scan. Failed checks covered here link straight to their article.