A tech post. A simple one for some people in tech, but many disciplines within the sector do not cover this, it it was a long forgotten lecture at uni.
Before attackers touch your network, they read your DNS.
Each of these records left empty is an open door. Here is what they see, and what it means:
1. CAA. Empty means any certificate authority can issue a cert for YOUR domain.
Publish: 0 issue "letsencrypt.org" (list the CAs you actually use).
2. SPF. Empty means anyone can send mail as your servers.
Publish: v=spf1 <your senders> ~all, and exactly ONE SPF record.
3. DMARC. Empty means phishers spoof your exact domain to your own staff.
Publish: v=DMARC1; p=none; rua=mailto:you@yourdomain.
Read the reports, then ratchet to p=reject.
4. DNSSEC. Unsigned means your DNS answers can be forged. Enable auto-signing at your DNS provider and publish the DS record at your registrar.
Proof: dig @1.1.1.1 yourdomain +dnssec returns the ad flag.
5. MTA-STS. Empty means attackers can strip encryption off your inbound mail.
Publish a "v=STSv1" TXT at _mta-sts plus the policy file at
https://mta-sts.yourdomain/.well-known/mta-sts.txt. Add TLS-RPT to see failures.
6. Null MX. Your parked domains are free spoofing stationery.
Publish: MX 0 . plus "v=spf1 -all".