evo1ve.com.br

What is this?

CAA (Certification Authority Authorization) is a DNS record that specifies which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for your domain.

Why does it matter?

Without CAA records, any of the hundreds of trusted CAs worldwide can issue a certificate for your domain. A compromised or rogue CA could issue a fraudulent certificate for your domain, enabling MITM attacks. CAA limits this risk to your chosen CA(s).

How to fix it

Add CAA records to your DNS. Example for Let\'s Encrypt only: 0 issue "letsencrypt.org" For multiple CAs (e.g. Let\'s Encrypt + DigiCert): 0 issue "letsencrypt.org" 0 issue "digicert.com" To also allow wildcard certificates: 0 issuewild "letsencrypt.org" For email notifications on unauthorized issuance attempts: 0 iodef "mailto:security@yourdomain.com" Check current CAA records at: sslmate.com/caa

What is this?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The signature is created with a private key on your mail server and verified by recipients using a public key published in DNS.

Why does it matter?

DKIM proves that an email actually came from your mail server and was not modified in transit. Without DKIM, anyone can send emails that appear to be from your domain (spoofing), and DMARC alignment checks will fail even if SPF passes.

How to fix it

DKIM is configured in your email provider, not directly in DNS. Here is the process: 1. Generate a DKIM key pair in your email provider: - Google Workspace: Admin console → Apps → Gmail → Authenticate email - Microsoft 365: Admin center → Settings → Domains → DKIM - Mailchimp/SendGrid/Mailjet: Each has a DKIM setup page in their dashboard 2. Copy the TXT record they provide and add it to your DNS: Name: selector._domainkey.yourdomain.com Value: v=DKIM1; k=rsa; p=MIGf... 3. Activate DKIM signing in your provider after publishing the DNS record. The selector name (e.g. 'google', 'selector1') comes from your email provider.

What is this?

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that forces other mail servers to use encrypted TLS connections when delivering email to your domain. Without it, a network attacker could silently strip TLS from email in transit.

Why does it matter?

Email is delivered between servers using SMTP. By default, SMTP tries TLS but falls back to plaintext if TLS is not available — a downgrade attack. MTA-STS prevents this fallback, ensuring all email delivered to your domain is encrypted in transit.

How to fix it

Implementing MTA-STS requires two things: 1. A DNS TXT record at _mta-sts.yourdomain.com: v=STSv1; id=20240101001 2. A policy file hosted at: https://mta-sts.yourdomain.com/.well-known/mta-sts.txt Policy file content: version: STSv1 mode: enforce mx: mail.yourdomain.com max_age: 86400 Start with mode: testing to see reports before enforcing. Use mta-sts.io for a guided setup.

What is this?

Common CMS admin panel paths like /wp-admin or /administrator are publicly accessible without any IP restriction.

Why does it matter?

A publicly accessible admin panel is a target for brute-force attacks and credential stuffing. Attackers continuously scan the web for these paths and run automated login attempts. If credentials are weak or reused, this is how sites get compromised.

How to fix it

Option 1: IP restriction (most secure) Nginx: location /wp-admin { allow your.ip.address; deny all; } Option 2: Two-factor authentication WordPress: install WP 2FA or Google Authenticator plugin Option 3: Move the admin URL (WordPress only) Install WPS Hide Login plugin to change /wp-admin to a custom path Option 4: HTTP Basic Auth as extra layer Add a password prompt before the admin panel is shown

What is this?

Permissions-Policy (formerly Feature-Policy) lets you control which browser features and APIs your site is allowed to use, and whether third-party content embedded in iframes can access them.

Why does it matter?

Without this header, embedded third-party scripts or iframes could theoretically request access to the camera, microphone, geolocation, payment APIs, and more. Restricting these features reduces your attack surface.

How to fix it

Example header that disables features not needed for most sites: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() Nginx: add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; Apache: Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()" Only disable features you genuinely don't use. Adding this header is a low-effort, high-value improvement.

What is this?

CORS (Cross-Origin Resource Sharing) controls which external websites are allowed to make requests to your server and read the response. The Access-Control-Allow-Origin header tells the browser which origins are permitted.

Why does it matter?

Setting Access-Control-Allow-Origin: * means any website can make requests to your server and read responses. If your site handles any authenticated data or sensitive information, this can allow malicious sites to read that data on behalf of a logged-in user.

How to fix it

Replace the wildcard with specific trusted origins: Access-Control-Allow-Origin: https://yourapp.com Nginx: add_header Access-Control-Allow-Origin "https://yourapp.com" always; Apache: Header always set Access-Control-Allow-Origin "https://yourapp.com" If you need to allow multiple origins, check the request Origin header and echo it back only if it matches an allow-list — a wildcard cannot be combined with credentials.