Domain & server security checklist

Domain & server security checklist

Extension of the  ⁠⁠IT security checklist for the IT lead ⁠  focused on domain infrastructure, email authentication, and website security. Run these checks periodically, many can be automated.


8. Email Domain Security E-Mail

SPF

Verify with:  easydmarc.com/tools/spf-lookup 
An SPF (Sender Policy Framework) record exists for the domain required Specifies which mail servers are authorised to send email on behalf of your domain.
The SPF record does not use overly permissive qualifiers required Avoid +all or ?all — these allow any server to send on your behalf. Use -all (hard fail) or ~all (soft fail).

DKIM

Verify with:  easydmarc.com/tools/dkim-lookup Solution:  ⁠⁠How to: Verify and configure DKIM signing⁠ 
DKIM signing is enabled for all outgoing mail required Adds a cryptographic signature to outgoing email so receiving servers can verify it hasn't been tampered with.
DKIM keys are at least 2048-bit required 1024-bit keys are considered weak and should be rotated.

DMARC

Verify with:  easydmarc.com/tools/dmarc-lookup Solution:  ⁠⁠How to: Resolve DMARC policy issues⁠ 
A DMARC record exists for the domain required Tells receiving servers what to do with email that fails SPF or DKIM checks.
DMARC policy is set to quarantine or reject required p=none only monitors — it provides no protection against spoofing.
A DMARC reporting address (rua=) is configured recommended Without this, you have no visibility into spoofing attempts or delivery issues.


9. DNS Infrastructure Security Building Construction

DNSSEC

Verify with:  internet.nl/site  (+ for troubleshooting:  dnsviz.net/d/[domain]/dnssec/ )Solution:  ⁠⁠How to: Enable DNSSEC⁠ 
DNSSEC is enabled on the domain's DNS zone recommended Adds cryptographic signatures to DNS records, preventing DNS hijacking/spoofing.
The DS record is present at the registrar recommended The chain of trust is only complete if the DS record is published at the registrar — not just the DNS hosting provider.

MTA-STS

Verify with:  easydmarc.com/tools/mta-sts-check  (or:  internet.nl/mail )
An MTA-STS policy is published recommended Ensure other mail servers can verify your TLS requirements by publishing a policy file at https://mta-sts.[yourdomain]/.well-known/mta-sts.txt with mode: enforce.

TLS-RPT

Verify with:  easydmarc.com/tools/tls-rpt-check 
Solution:  ⁠⁠How to: Enable MTA-STS & TLS-RPT⁠ 
TLS-RPT is configured alongside MTA-STS recommended The _smtp._tls DNS record enables reporting on email delivery failures.


10. Website & CMS Security Globe with Meridians

General

Verify with  securityheaders.com  or  observatory.mozilla.org Solutions: ⁠⁠How to: Enforce HTTPS and automate SSL/TLS renewal⁠   ⁠⁠How to: Add missing HTTP security headers (WordPress)⁠   ⁠⁠How to: Implement a Content Security Policy (CSP)⁠ 
The website runs entirely over HTTPS required No mixed content. SSL/TLS certificate is valid and not expired — automate renewal where possible (e.g. Let's Encrypt).
HSTS is enabled required Prevents browsers from loading the site over plain HTTP.
Security headers are configured recommended At minimum: X-Frame-Options , X-Content-Type-Options , Content-Security-Policy .

WordPress-specific

Follow these steps:  ⁠⁠How to: Harden a WordPress installation⁠ 
WordPress core, plugins, and active theme are up to date required Most WP compromises exploit known vulnerabilities in outdated plugins.
No unused plugins or themes are installed required Inactive plugins are still an attack surface.
The default admin username is not in use required It's the first username attackers try.
wp-login.php is protected recommended Apply rate limiting, 2FA, or relocate the login URL to reduce brute-force exposure.
XML-RPC is disabled if not needed recommended /xmlrpc.php is a frequent target for brute-force and DDoS amplification attacks.
 WPScan  is run periodically to detect known vulnerabilities recommendedWPScan detects issues that haven't yet been patched or flagged by WordPress itself.