TL;DR: Most domain security gaps take under an hour to fix once you know they exist. Run a free Kalenfy scan to find yours in 10 seconds, then work through the 12 checks below to close them one by one.
Email authentication (3 records, highest priority)
1 — SPF record
An SPF TXT record on your root domain lists every server authorised to send email as your
domain. Without it, any server can impersonate you. Check: dig TXT yourdomain.com
should return a string starting with v=spf1.
Common gaps: missing record, two records (breaks SPF), or more than 10 DNS lookups. Fix guide: SPF records explained.
2 — DKIM signature
DKIM adds a cryptographic signature to outgoing email so receivers can verify the message
wasn't altered in transit. It is also required for DMARC alignment when SPF fails.
Check: your email platform (Google Workspace, Microsoft 365, Mailchimp etc.) should show
DKIM as enabled and you should see dkim=pass in Gmail raw headers.
Fix guide: Set up DKIM for Google Workspace and Microsoft 365.
3 — DMARC policy
DMARC ties SPF and DKIM together and tells receiving servers what to do when both fail —
nothing (p=none), quarantine, or reject. Without DMARC at
p=reject, anyone can send email that appears to come from your domain.
Check: dig TXT _dmarc.yourdomain.com should return a string starting with
v=DMARC1 and ideally ending with p=reject.
Fix guide: What is DMARC and how to set it up.
DNS security
4 — DNSSEC
DNSSEC signs your DNS records cryptographically so attackers cannot redirect your traffic
by poisoning DNS resolvers. Check: Kalenfy scan or
dig DS yourdomain.com (should return a key if DNSSEC is enabled).
Enable it in your domain registrar's control panel — most offer it for free.
Background: What is DNSSEC.
5 — CAA record
A CAA record restricts which certificate authorities can issue SSL/TLS certificates for
your domain. Without one, any CA can issue a certificate — useful to attackers for
phishing sites. Check: dig CAA yourdomain.com.
Fix guide: What is a CAA record.
6 — No wildcard DNS records
A wildcard DNS record (*.yourdomain.com) resolves any subdomain, including
ones that point to abandoned third-party services. Attackers can claim those services and
take over the subdomain. Check: dig A *.yourdomain.com should return nothing.
Background: Wildcard DNS and subdomain takeover.
7 — MX records point to your actual mail provider
Verify your MX records resolve to your actual email provider, not an old or expired service. Orphaned MX records can allow an attacker to receive email sent to your domain.
HTTPS and certificates
8 — Valid SSL/TLS certificate
Your certificate should be valid (not expired), issued by a trusted CA, and cover
the exact domains and subdomains you serve. Check: browser padlock, or
openssl s_client -connect yourdomain.com:443.
Background: What is an SSL certificate.
9 — HTTP redirects to HTTPS
All HTTP traffic should be permanently redirected (301) to HTTPS. Check:
curl -I http://yourdomain.com should return Location: https://....
Fix guide: How to redirect HTTP to HTTPS.
10 — HSTS header
HSTS tells browsers to always use HTTPS for your domain, even before the redirect.
Check: curl -I https://yourdomain.com should include
Strict-Transport-Security: max-age=31536000.
Background: What is HSTS.
Web security headers
11 — Core security headers
Four headers protect against the most common web attacks:
| Header | Protects against |
|---|---|
Content-Security-Policy | XSS, data injection |
X-Frame-Options | Clickjacking |
X-Content-Type-Options | MIME-type sniffing |
Referrer-Policy | Data leakage via referrer |
Check: Kalenfy scan reports all four with pass/fail. Background: HTTP security headers explained.
12 — Cookie security flags
Cookies that carry session data should have HttpOnly (no JS access),
Secure (HTTPS only), and SameSite=Strict or Lax
(CSRF protection) flags set. Check browser DevTools → Application → Cookies.
Background: Cookie security flags.
How to run all 12 checks in under 60 seconds
Instead of running each DNS query and curl command manually, scan your domain at Kalenfy — it checks all 12 automatically and gives you a letter grade with plain-English descriptions of every failure. Download the PDF report to track fixes over time or share with your developer.
FAQ
Which of these 12 should I fix first?
Priority order: DMARC to p=reject (stops spoofing) → SPF and DKIM (required
for DMARC to work) → HTTPS + HSTS → security headers → DNSSEC → CAA.
The email records have the highest immediate business risk — attackers sending invoices
as your domain can cause direct financial harm in hours.
Do I need technical knowledge to fix these?
SPF, DKIM and DMARC require DNS access (usually your domain registrar or hosting panel) and following a step-by-step guide — no coding needed. Security headers and HSTS require access to your web server config or CDN settings. DNSSEC and CAA are typically one-click in the registrar panel.
How often should I re-run this checklist?
Run it whenever you add a new email service or tool, change DNS, move hosting, or renew your domain. A quarterly scan catches silent breakage — DNS records can stop working when a third-party ESP changes infrastructure without notice.