Web Security 101

Search and browse security terms. Click on highlighted terms within definitions to jump to related concepts.

Email authentication prevents attackers from sending emails that appear to come from your domain. These protocols work together in layers to protect your domain's reputation, verify message integrity, and ensure secure transmission.

Why Email Authentication Matters

Email was designed in the 1970s without authentication—anyone could claim to send from any address. This fundamental flaw enables:

SPF (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. It's the first line of defense against email spoofing.

SPF Record Syntax Explained:

v=spf1 ip4:192.0.2.0/24 include:_spf.google.com include:sendgrid.net -all
│      │                 │                        │                   │
│      │                 │                        │                   └─ Policy for non-matches
│      │                 │                        └─ Include SendGrid's SPF
│      │                 └─ Include Google's SPF record
│      └─ Allow this IP range
└─ SPF version (always v=spf1)

SPF Mechanisms:

SPF Qualifiers (the prefix before mechanisms):

Common SPF Records for Popular Providers:

# Google Workspace
v=spf1 include:_spf.google.com ~all

# Microsoft 365
v=spf1 include:spf.protection.outlook.com ~all

# Amazon SES
v=spf1 include:amazonses.com ~all

# Multiple providers (common real-world example)
v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to emails, proving the message hasn't been altered in transit and was authorized by the domain owner.

DKIM Signature Header Example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=example.com; s=selector1;
    h=from:to:subject:date:message-id;
    bh=base64hashOfBody==;
    b=base64SignatureValue...

DKIM Parameters Explained:

DKIM DNS Record:

# DNS Record Name:
selector1._domainkey.example.com

# DNS Record Value (TXT):
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together, tells receivers what to do when checks fail, and provides visibility through reporting.

DMARC Record Syntax:

v=DMARC1; p=reject; sp=quarantine; pct=100; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; adkim=r; aspf=r
│        │         │              │        │                              │                                      │        │
│        │         │              │        │                              │                                      │        └─ SPF alignment mode
│        │         │              │        │                              │                                      └─ DKIM alignment mode
│        │         │              │        │                              └─ Forensic report address
│        │         │              │        └─ Aggregate report address
│        │         │              └─ Percentage of mail to apply policy to
│        │         └─ Subdomain policy
│        └─ Policy (none/quarantine/reject)
└─ Version

DMARC Policies:

DMARC Implementation Path:

MTA-STS (Mail Transfer Agent Strict Transport Security)

MTA-STS forces other mail servers to use encrypted TLS connections when delivering email to your domain, preventing man-in-the-middle attacks and downgrade attacks on email transmission.

Setting Up MTA-STS (2 components):

1. DNS Record:

# TXT record for _mta-sts.yourdomain.com
v=STSv1; id=20240115120000

The id must change whenever you update the policy (use timestamp or version number).

2. Policy File (served via HTTPS):

Host this file at: https://mta-sts.yourdomain.com/.well-known/mta-sts.txt

version: STSv1
mode: enforce
mx: mail.yourdomain.com
mx: backup-mail.yourdomain.com
max_age: 604800

MTA-STS Modes:

TLS-RPT (TLS Reporting)

TLS-RPT provides reporting for MTA-STS (and DANE). It tells you when other servers have trouble establishing secure connections to your mail servers.

# TXT record for _smtp._tls.yourdomain.com
v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com

What TLS-RPT reports tell you:

• Certificate validation failures
• MTA-STS policy fetch failures
• STARTTLS negotiation failures
• Which sending domains had issues reaching you

BIMI (Brand Indicators for Message Identification)

BIMI displays your verified brand logo next to emails in supported mail clients (Gmail, Apple Mail, Yahoo). It requires DMARC enforcement and optionally a Verified Mark Certificate (VMC).

BIMI Prerequisites:

1. DMARC policy of p=quarantine or p=reject
2. Logo in SVG Tiny PS format (specific requirements)
3. Optional: Verified Mark Certificate (VMC) from DigiCert or Entrust (~$1,500/year) — required by Gmail

BIMI DNS Record:

# TXT record for default._bimi.yourdomain.com

# Without VMC (works in Yahoo, some clients)
v=BIMI1; l=https://example.com/brand/logo.svg

# With VMC (required for Gmail)
v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem

Complete Email Security Checklist

SSL/TLS certificates encrypt data between your users and your server, verify your server's identity, and are essential for any website handling sensitive information. Understanding how TLS works helps you configure it securely.

What TLS Provides

How the TLS Handshake Works

Before encrypted communication begins, client and server perform a "handshake" to agree on encryption parameters and verify identities.

Certificate Chain of Trust

Browsers trust certificates because they're signed by trusted Certificate Authorities (CAs). This creates a chain:

Certificate Types

Wildcard vs. SAN Certificates

TLS Protocol Versions

Understanding Cipher Suites

A cipher suite is a combination of algorithms used for key exchange, authentication, encryption, and message integrity.

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
│   │     │        │   │   │    │
│   │     │        │   │   │    └─ MAC algorithm (integrity)
│   │     │        │   │   └─ Key size
│   │     │        │   └─ Mode (GCM = authenticated encryption)
│   │     │        └─ Bulk encryption algorithm
│   │     └─ Authentication (certificate type)
│   └─ Key exchange algorithm
└─ Protocol

Recommended Cipher Suites (Nginx):

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;  # Let client choose (TLS 1.3 doesn't use this)

Certificate Transparency (CT)

Certificate Transparency is a system where CAs must log all issued certificates publicly. This helps detect misissued or malicious certificates.

Certificate Revocation

When a private key is compromised or a certificate is misissued, it must be revoked. Browsers check revocation status via:

Enable OCSP Stapling (Nginx):

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/chain.pem;  # CA chain for verification
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

Getting a Free SSL Certificate (Let's Encrypt)

Let's Encrypt provides free, automated SSL certificates. Certbot is the recommended client.

# Ubuntu/Debian
sudo apt update
sudo apt install certbot python3-certbot-nginx

# Get certificate (auto-configures Nginx)
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Test auto-renewal
sudo certbot renew --dry-run

# Ubuntu/Debian
sudo apt update
sudo apt install certbot python3-certbot-apache

# Get certificate (auto-configures Apache)
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

# Test auto-renewal
sudo certbot renew --dry-run

# Stop web server temporarily
sudo systemctl stop nginx

# Get certificate (Certbot runs its own server on port 80)
sudo certbot certonly --standalone -d yourdomain.com -d www.yourdomain.com

# Certificates saved to /etc/letsencrypt/live/yourdomain.com/
# - fullchain.pem (cert + intermediate)
# - privkey.pem (private key)

# Restart web server
sudo systemctl start nginx

Force HTTPS Redirect

Always redirect HTTP to HTTPS. This ensures users who type your domain without https:// still get encrypted connections.

# Redirect all HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

# HTTPS server block
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # ... rest of config
}

# In .htaccess or VirtualHost config
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Or in Apache 2.4+ VirtualHost:
<VirtualHost *:80>
    ServerName yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>

Complete Secure Nginx SSL Configuration

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name yourdomain.com;

    # Certificate files
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # SSL/TLS settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/yourdomain.com/chain.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Session settings
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;  # Disable for forward secrecy

    # DH parameters (generate with: openssl dhparam -out /etc/nginx/dhparam.pem 2048)
    ssl_dhparam /etc/nginx/dhparam.pem;

    # HSTS (uncomment after testing)
    # add_header Strict-Transport-Security "max-age=63072000" always;

    # ... rest of server config
}

Security headers are HTTP response headers that instruct browsers how to behave when handling your content. They're your first line of defense against XSS, clickjacking, and many other client-side attacks—and they cost nothing to implement.

Why Security Headers Matter

Even with secure server-side code, browsers need instructions on how to protect users. Without security headers:

Security Headers Quick Reference

Strict-Transport-Security (HSTS)

HSTS tells browsers to always use HTTPS for your domain, even if the user types http:// or clicks an HTTP link.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
│                          │               │                   │
│                          │               │                   └─ Eligible for browser preload list
│                          │               └─ Apply to all subdomains
│                          └─ Remember for 1 year (in seconds)
└─ Header name

HSTS Directives:

Content-Security-Policy (CSP)

CSP is the most powerful security header. It tells browsers exactly which resources are allowed to load, effectively blocking most XSS attacks even if your code has vulnerabilities.

CSP Directive Reference:

CSP Source Values:

$nonce = base64_encode(random_bytes(16));  // PHP example

Content-Security-Policy: script-src 'nonce-abc123RandomValue=='

<script nonce="abc123RandomValue==">
    // This script will execute
    console.log("Allowed by nonce");
</script>

<script>
    // This script (no nonce) will be BLOCKED
    maliciousCode();
</script>

Example CSP Policies:

Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; upgrade-insecure-requests

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri /csp-report-endpoint

X-Frame-Options

Controls whether your page can be embedded in <iframe>, <frame>, or <object> elements. Prevents clickjacking attacks.

<!-- Attacker's page -->
<button>Click to win a prize!</button>
<iframe src="https://yourbank.com/transfer?to=attacker&amount=1000"
        style="opacity: 0; position: absolute; top: 0;">
</iframe>

# Block all framing
X-Frame-Options: DENY

# Allow same-origin framing only
X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

Prevents browsers from "sniffing" the MIME type, forcing them to respect the declared Content-Type.

<script>alert('XSS')</script>

X-Content-Type-Options: nosniff

Referrer-Policy

Controls how much URL information is sent in the Referer header when users navigate away from your site.

# Recommended: full URL internally, origin only externally, nothing on downgrade
Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy (Feature-Policy)

Controls which browser features and APIs your page can use. Prevents embedded content from accessing sensitive capabilities.

# Disable sensitive features
Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=()

# Allow only same-origin to use geolocation
Permissions-Policy: geolocation=(self)

# Allow specific iframe to use camera
Permissions-Policy: camera=(self "https://trusted-video-app.com")

Common Features to Restrict:

Cross-Origin Isolation Headers

These headers provide protection against side-channel attacks (like Spectre) and control how your resources interact with other origins.

# Isolate from cross-origin openers (security) but allow popups
Cross-Origin-Opener-Policy: same-origin-allow-popups

# Full isolation (breaks window.opener references)
Cross-Origin-Opener-Policy: same-origin

# Require CORS/CORP for all subresources
Cross-Origin-Embedder-Policy: require-corp

# Credentialless mode (newer, more compatible)
Cross-Origin-Embedder-Policy: credentialless

# Only same-site can embed our resources
Cross-Origin-Resource-Policy: same-site

# Only same-origin (stricter)
Cross-Origin-Resource-Policy: same-origin

# Anyone can embed (for CDNs/public APIs)
Cross-Origin-Resource-Policy: cross-origin

Complete Server Configurations

# /etc/nginx/conf.d/security-headers.conf (include in server blocks)

# HTTPS enforcement
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# XSS and injection protection
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests" always;

# Clickjacking protection
add_header X-Frame-Options "SAMEORIGIN" always;

# MIME sniffing protection
add_header X-Content-Type-Options "nosniff" always;

# Referrer control
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Feature restrictions
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always;

# Cross-origin isolation
add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
add_header Cross-Origin-Resource-Policy "same-site" always;

# Remove server identification
server_tokens off;
more_clear_headers Server;

# .htaccess or Apache config

<IfModule mod_headers.c>
    # HTTPS enforcement
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # XSS and injection protection
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests"

    # Clickjacking protection
    Header always set X-Frame-Options "SAMEORIGIN"

    # MIME sniffing protection
    Header always set X-Content-Type-Options "nosniff"

    # Referrer control
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Feature restrictions
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"

    # Cross-origin isolation
    Header always set Cross-Origin-Opener-Policy "same-origin-allow-popups"
    Header always set Cross-Origin-Resource-Policy "same-site"

    # Remove server identification
    Header unset Server
    Header always unset X-Powered-By
</IfModule>

# Hide Apache version
ServerTokens Prod
ServerSignature Off

# Add these as "Set static" rules:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Cross-Origin-Opener-Policy: same-origin-allow-popups

# For CSP, use Page Rules or Workers for complex policies

DNS (Domain Name System) is the internet's phone book, translating domain names to IP addresses. Because almost everything starts with a DNS lookup, DNS security is foundational—if attackers control your DNS, they control your traffic.

How DNS Works

Understanding DNS resolution helps you understand where attacks can occur.

DNS Record Types Explained

Common DNS Attacks

CAA Records (Certificate Authority Authorization)

CAA records specify which Certificate Authorities (CAs) are permitted to issue certificates for your domain. Without CAA, any CA can issue a certificate for your domain.

# Allow only Let's Encrypt to issue certificates
example.com.    CAA    0 issue "letsencrypt.org"

# Allow wildcard certificates only from Let's Encrypt
example.com.    CAA    0 issuewild "letsencrypt.org"

# Report violations to your email
example.com.    CAA    0 iodef "mailto:security@example.com"

# Block all CAs (use carefully!)
example.com.    CAA    0 issue ";"

CAA Tag Reference:

DNSSEC (DNS Security Extensions)

DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that responses haven't been tampered with.

Enabling DNSSEC:

1. DNS Provider: Enable DNSSEC signing in your DNS provider's control panel (Cloudflare, Route53, etc.)
2. Registrar: Add the DS record to your domain registrar (links your zone to the parent)
3. Verify: Use DNSViz or dig +dnssec to confirm

# Check DNSSEC status
dig +dnssec example.com

# Look for 'ad' flag (Authenticated Data) in response
# ;; flags: qr rd ra ad;

# Query for DNSKEY records
dig DNSKEY example.com +short

Encrypted DNS (DoH & DoT)

Traditional DNS is unencrypted—anyone on the network path can see your queries. Encrypted DNS protocols protect privacy.

Popular Public DoH/DoT Resolvers:

DNS Security Best Practices

Understanding TTL (Time to Live)

TTL determines how long DNS resolvers cache your records. It's a balance between performance and flexibility.

DNS Monitoring and Alerting

You should know immediately if your DNS records change unexpectedly. Set up monitoring for:

• A/AAAA record changes: Detect if your site's IP changes
• NS record changes: Critical - indicates potential hijacking
• MX record changes: Could indicate email interception attempt
• New certificates: Monitor Certificate Transparency logs
• WHOIS changes: Registrar or owner changes

DNS Security Checklist

Understanding common threats helps you better protect your websites and recognize potential attacks.

These tools can help you assess and improve your website's security posture. Most are free, open-source, or offer free tiers for basic use.

Domain & URL Analysis

SSL/TLS & Headers Analysis

DNS & Email Security

Threat Intelligence & OSINT

Vulnerability & Web App Scanning

Reconnaissance & OSINT

Data Breach & Credential Checking

Browser & Network Tools

Deepen your knowledge of web security with these trusted external resources from industry leaders and security organizations.

Security Organizations & Standards

Web Security Documentation

Threat Intelligence & News