Skip to main content

Pro audit program · v1.0

DNS & Email Hygiene

SPF, DKIM, DMARC, DNSSEC and recursive-resolver hardening — the basics of internet plumbing you probably forgot to check.

  • General target area
  • CIS Controls framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

SPF, DKIM, DMARC, DNSSEC and recursive-resolver hardening — the basics of internet plumbing you probably forgot to check.

Risks addressed

  • Critical Attackers spoof corporate domain in phishing campaigns
  • High DNS hijack redirects users to attacker infrastructure
  • Medium Internal devices resolve known-bad domains
  • Medium Lookalike domain registered without detection

Controls (6)

  1. SPF record published and aligned

    High

    Sender Policy Framework (SPF) is a DNS-based email authentication mechanism that allows domain owners to publish authorized mail servers in a TXT record. When properly aligned with the organizational domain, SPF records enable receiving mail servers to verify that inbound…

    How to test + evidence

    Testing procedure: dig TXT for each sending domain; confirm SPF exists with -all (hard fail).

    Evidence to collect: dig output.

  2. DKIM signing on all sending streams

    High

    DomainKeys Identified Mail (DKIM) is a cryptographic email authentication method that allows an organization to take responsibility for transmitting a message by signing it with a private key. The corresponding public key is published in the domain's DNS records, enabling…

    How to test + evidence

    Testing procedure: Confirm every outbound mail stream signs with a valid DKIM selector + key length >= 2048.

    Evidence to collect: DKIM key export.

  3. DMARC policy at p=quarantine or stricter

    Critical

    DMARC (Domain-based Message Authentication, Reporting and Conformencing) is an email authentication protocol that builds on SPF and DKIM to prevent email spoofing and phishing attacks using an organization's domain. A DMARC policy of 'p=quarantine' instructs receiving mail servers to treat…

    How to test + evidence

    Testing procedure: dig TXT _dmarc.<domain>; expect p=quarantine or p=reject with reporting addresses.

    Evidence to collect: dig output + DMARC report sample.

  4. DNSSEC enabled on primary domains

    Medium

    DNSSEC (Domain Name System Security Extensions) is a suite of cryptographic protocols that adds digital signature layers to DNS records, enabling resolvers to verify the authenticity and integrity of DNS responses. When enabled on primary organizational domains, DNSSEC prevents attackers…

    How to test + evidence

    Testing procedure: Use a DNSSEC checker; verify chain of trust on apex domain.

    Evidence to collect: DNSSEC validation screenshot.

  5. Recursive resolvers hardened

    Medium

    Recursive DNS resolvers must be hardened against abuse by restricting queries to authorized clients, disabling open recursion, implementing rate limiting, and enabling DNSSEC validation. Without hardening, recursive resolvers can be exploited for DNS amplification attacks, cache poisoning, or reconnaissance activities.…

    How to test + evidence

    Testing procedure: Internal resolvers block known-bad domains (Quad9 / Cloudflare / NCSC PDNS).

    Evidence to collect: Resolver config or PDNS contract.

  6. Lookalike-domain monitoring

    Low

    Lookalike-domain monitoring is a continuous surveillance program that identifies and tracks domain registrations that closely resemble an organization's legitimate domains through character substitution (typosquatting), homoglyphs, combosquatting, or TLD variations. The control typically employs specialized monitoring services, WHOIS data feeds, certificate…

    How to test + evidence

    Testing procedure: Monitoring tool alerts on registration of similar domains.

    Evidence to collect: Tool config + sample alert.