4 ms·

I don’t see any mention of domain names. Domain names should be set up properly, like implementing dnssec, dmarc, dkim, spf, and using a secure registrar. So ma

I don’t see any mention of domain names. Domain names should be set up properly, like implementing dnssec, dmarc, dkim, spf, and using a secure registrar. So many overlook domain security.

k__ 5y ago
Any resources on this?
- ramimac 5y ago
  https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop-email-spoofing https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop... is a pretty good primer on spoofing (SPF, DKIM, DMARC)
StavrosK 5y ago
What's a good secure registrar?
- bhartzer 5y ago
  I can tell you which ones not to use based on which registrars have had domain names stolen frequently.
  - StavrosK 5y ago
    That helps as well.
- toomuchtodo 5y ago
  Cloudflare, but you can’t register with them, only transfer in. I buy at Namecheap, and then transfer in. Edit: Based on Austin’s below reply it looks like you can register directly with Cloudflare now. Thanks Austin!
  - austinkhale 5y ago
    You actually can register with them and they promise to provide registration at cost forever: https://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/ Note: They released the beta fairly recently, which is why a lot of folks don’t know about it yet.
tptacek 5y ago
Implementing DNSSEC is definitely not a security best practice; virtually none of the best-regarded security teams have implemented it.
- bhartzer 5y ago
  Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it. Honestly, I thinks it’s a case that most people don’t know about it, so they don’t know to implement it. The same goes for DMARC as well.
  - wglb 5y ago
    > Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it Unclear how it makes sense to do something allegedly security related that best-regarded security teams recommend against. Sounds like security theater. Meanwhile, consider the failures: https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html Misconfiguation can cause the sites to disappear from the internet.
    - bhartzer 5y ago
      I haven’t seen any security teams recommend against implementing dnssec. Interesting to see info about the failures, though. Thanks for pointing that out. I’ve been running a ton of sites on domains with dnssec enabled and haven’t had any issues that I’m aware of.
      - tptacek 5y ago
        The IETF has been trying to light a fire under organizations to deploy DNSSEC since 2008. You can take any list of popular domains --- last time I did this, I used the "Moz 500", whatever that is --- and write a simple shell loop around `host -t ds ${domain}" to see how many of those domains are signed. You'll see some! But they're overwhelmingly affiliated either with academia or with the US government, which, until 2017, mandated DNSSEC, but later rescinded the mandate. DNSSEC has virtually no real-world commercial deployment. There have been years, I believe, when US deployment went down. It's dead. Let it lie.
technion 5y ago
DKIM increases your chances of getting mail into an inbox. There's no "negative signal", that is, a recipient has no way of knowing emails were meant to be signed and weren't. I know you can provide indications with DMARC, but the usual thing is that if an email is SPF verified then it's considered legitimate even when not signed. Accordingly, DKIM can help land emails but only helps security in the unusual situation where you're trying to argue something in an inbox definitely came from you.
rockwotj 5y ago
If you're hosting user content I always recommend hosting that on another domain. There is plenty of prior art about this on hacker news. Example: https://news.ycombinator.com/item?id=25802366 https://news.ycombinator.com/item?id=25802366
ramimac 5y ago
Unless they're rapidly editing this based on the thread you missed the mention. I currently see "Ensure that your domain names are protected" under "Your company." It doesn't really mention spoofing controls and deliverability, but does talk about registration and hijack prevention!

I don’t see any mention of domain names. Domain names should be set up properly, like implementing dnssec, dmarc, dkim, spf, and using a secure registrar. So many overlook domain security.

k__ 5y ago

Any resources on this?

ramimac 5y ago
https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop-email-spoofing https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop... is a pretty good primer on spoofing (SPF, DKIM, DMARC)

StavrosK 5y ago

What's a good secure registrar?

bhartzer 5y ago
I can tell you which ones not to use based on which registrars have had domain names stolen frequently.
- StavrosK 5y ago
  That helps as well.
toomuchtodo 5y ago
Cloudflare, but you can’t register with them, only transfer in. I buy at Namecheap, and then transfer in. Edit: Based on Austin’s below reply it looks like you can register directly with Cloudflare now. Thanks Austin!
- austinkhale 5y ago
  You actually can register with them and they promise to provide registration at cost forever: https://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/ Note: They released the beta fairly recently, which is why a lot of folks don’t know about it yet.

tptacek 5y ago

Implementing DNSSEC is definitely not a security best practice; virtually none of the best-regarded security teams have implemented it.

bhartzer 5y ago
Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it. Honestly, I thinks it’s a case that most people don’t know about it, so they don’t know to implement it. The same goes for DMARC as well.
- wglb 5y ago
  > Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it Unclear how it makes sense to do something allegedly security related that best-regarded security teams recommend against. Sounds like security theater. Meanwhile, consider the failures: https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html Misconfiguation can cause the sites to disappear from the internet.
  - bhartzer 5y ago
    I haven’t seen any security teams recommend against implementing dnssec. Interesting to see info about the failures, though. Thanks for pointing that out. I’ve been running a ton of sites on domains with dnssec enabled and haven’t had any issues that I’m aware of.
    - tptacek 5y ago
      The IETF has been trying to light a fire under organizations to deploy DNSSEC since 2008. You can take any list of popular domains --- last time I did this, I used the "Moz 500", whatever that is --- and write a simple shell loop around `host -t ds ${domain}" to see how many of those domains are signed. You'll see some! But they're overwhelmingly affiliated either with academia or with the US government, which, until 2017, mandated DNSSEC, but later rescinded the mandate. DNSSEC has virtually no real-world commercial deployment. There have been years, I believe, when US deployment went down. It's dead. Let it lie.

technion 5y ago

DKIM increases your chances of getting mail into an inbox. There's no "negative signal", that is, a recipient has no way of knowing emails were meant to be signed and weren't. I know you can provide indications with DMARC, but the usual thing is that if an email is SPF verified then it's considered legitimate even when not signed. Accordingly, DKIM can help land emails but only helps security in the unusual situation where you're trying to argue something in an inbox definitely came from you.

rockwotj 5y ago

If you're hosting user content I always recommend hosting that on another domain. There is plenty of prior art about this on hacker news. Example: https://news.ycombinator.com/item?id=25802366 https://news.ycombinator.com/item?id=25802366

ramimac 5y ago

Unless they're rapidly editing this based on the thread you missed the mention. I currently see "Ensure that your domain names are protected" under "Your company." It doesn't really mention spoofing controls and deliverability, but does talk about registration and hijack prevention!