Guides
Plain-language guides to e-mail authentication, DNS, certificates, subdomains, security headers and look-alike domains, written for the people who run websites and have to fix the findings.
- E-mail
DKIM and DMARC for Brevo: authenticate your sending domain
Add the Brevo code, the two DKIM records and the DMARC record, keep your own DMARC reports, and check that Brevo signs your campaigns with your domain.
- Method
Cyber Essentials seen from outside: what the internet shows
Which Cyber Essentials requirements leave a trace anyone can see from the internet, how to check them before your assessment, and what the scheme does not cover.
- E-mail
DKIM, SPF and DMARC for Google Workspace: the complete setup
Turn on DKIM in the Google Admin console, publish the right SPF and DMARC records, check that mail really passes, and avoid the usual errors.
- E-mail
DKIM and DMARC for Mailchimp: authenticate your sending domain
Add the two CNAME records and the DMARC record Mailchimp asks for, check that your campaigns are signed with your own domain, and keep DMARC from breaking them.
- E-mail
DKIM, SPF and DMARC for Microsoft 365: the complete setup
Publish the two DKIM CNAME records Microsoft 365 asks for, turn signing on in the Defender portal, add SPF and DMARC, and check a real message.
- Method
Passive and active scanning: what each finds and when you need it
The difference between a passive audit and an active vulnerability scan, what each can and cannot see, the risks of active testing, and how to combine them safely.
- Method
Attack surface monitoring for small companies: what to watch
What an attacker sees of your company from outside before trying anything, the seven areas worth watching, how often to look, and how to do it without a security team.
- E-mail
From p=none to p=reject without losing a single e-mail
The safe path to an enforced DMARC policy: what to check at each step, how pct and sp work, how long to wait, and what to do when a legitimate service fails.
- Web
Open ports: databases and remote desktop exposed to the internet
Which services should never answer the whole internet, how attackers find them in minutes, how to see your own exposure without a scan, and how to close each one.
- E-mail
MTA-STS and TLS-RPT: making sure mail to you arrives encrypted
Why encryption between mail servers can be silently removed, how an MTA-STS policy and TLS reports prevent and reveal it, and how to set both up in an afternoon.
- Method
NIS2 for small and mid-sized companies: what it actually asks
Who NIS2 covers, the difference between essential and important entities, the ten security measures, the 24-hour reporting rule and where to start this month.
- E-mail
Reading DMARC reports: who sends mail in your name
What the XML files from Google, Microsoft and others contain, how to tell your own services from forgers, and which rows to fix before moving to p=reject.
- Method
API keys leaked on GitHub: how to find them and what to do
Why passwords and keys end up in public repositories, how attackers find them within minutes, and the order to act in: revoke first, clean the history second.
- Method
Supplier security under NIS2: a practical way to start
What Article 21 expects about your suppliers, how to list the ones that matter, what you can check from outside without asking, and when to send a questionnaire.
- Certificates
Watching Certificate Transparency logs for your own domain
Every public certificate is recorded in a public log. How to use those logs to find forgotten subdomains, catch unexpected issuance and see expiry coming.
- DNS
DNSSEC and CAA: two records that cost nothing
What DNSSEC protects against and why a broken deployment is worse than none, how a CAA record limits who can issue certificates for your domain, and how to turn both on.
- Look-alikes
Look-alike domains: spotting phishing before the first e-mail is sent
How typosquatting works, the ten ways attackers vary a domain name, why registration is the earliest warning you will get, and what to do when a look-alike appears.
- Web
The six security headers worth setting on every site
Which HTTP response headers actually reduce risk, what each one protects against, the exact values to use, and the mistakes that make a Content-Security-Policy useless.
- E-mail
SPF, DKIM and DMARC, explained for people who run websites
What the three e-mail authentication records do, how they fit together, and the exact records to publish so that nobody can send mail as your domain.
- Subdomains
Subdomain takeover: how a forgotten CNAME becomes someone else’s page
Why a DNS record pointing at a cloud service you stopped paying for lets a stranger publish under your domain, how to find such records and how to remove them.