Domain security, explained
Practical posts on email authentication, DNS, and domain security - written by the team that scans and grades domains every day.
CAA records: control who can issue certificates for your domain
A CAA record tells certificate authorities which of them may issue certificates for your domain, shrinking the surface for unauthorized issuance. This guide covers CAA syntax, ACME account pinning, and the dangling _acme-challenge delegation that can hand an attacker a trusted certificate.
What's new in SecRift 1.2
SecRift 1.2 is our biggest scan expansion yet - six new checks that cover your HTTPS setup, security headers, and DNS delegation, plus a cleaner report that puts the problems worth fixing first.
DNS delegation and exposure explained
DNS delegation is how the internet knows which servers speak for your domain, and getting it wrong quietly breaks resolution or leaks your whole zone. This guide covers delegation hygiene, open resolvers, and zone transfers.
HTTP security headers explained, and how SecRift scores yours
HTTP security headers are instructions your server sends to the browser - enforce HTTPS, block clickjacking, restrict scripts, limit what leaks in a Referer. None of them touch your certificate or your TLS setup. SecRift audits seven of them independently and tells you exactly which are missing.
TLS certificate best practices: validity, trust, and key strength
A TLS certificate proves your domain is really yours and lets browsers connect to it securely. When it expires, mismatches the hostname, or chains to a CA nobody trusts, every visitor sees a security warning. Here are the best practices for TLS certificates, and how SecRift scores yours across nine dimensions.
TLS configuration best practices: protocols, ciphers, and forward secrecy
TLS configuration decides how strong your encryption actually is - which protocol versions, cipher suites, and key-exchange parameters a server accepts. A valid certificate says nothing about any of it. Here are the best practices, and how SecRift scores yours.
What TLS vulnerabilities are and how to find them on your domain
TLS vulnerabilities like Heartbleed and ROBOT were patched years ago, yet they still turn up on live servers behind valid certificates. SecRift actively probes for four of them and tells you exactly which ones affect your domain.