I'm considering writing a zine about owning a domain! (DNS! registrars! certificates! TLS! HSTS! MX records!). What questions do you have about domains? Will try to answer as many as I can.
234
159
2,319
Conversation
This Tweet was deleted by the Tweet author. Learn more
Also really worth noting that email has no authenticated encryption without setting up MTA-STS and/or DANE TLSA records. Other email servers can't validate your server's certificate without doing this. Ideally, set up both, since many servers only use one of these to validate.
Google only uses MTA-STS. Many email servers in Europe use DANE. There's not much overlap where both are used.
Setting up an email server securely where you have authenticated encryption for inbound + outbound along with anti-spoofing for inbound + outbound is far from trivial.
1
1
As a great example of the difficulty in doing it, Google still uses DMARC p=none for gmail.com due to backwards compatibility concerns over broken email setups. That means sending spoofed emails as *@gmail.com works. Can be detected as likely spoofed but is allowed.
1
Show replies