Domain & Email
Security Assessment

Selectors checked: 21
Found: 0

dig TXT default._domainkey.houstons.tech +short → No answer
dig TXT selector1._domainkey.houstons.tech +short → No answer
dig TXT fe-._domainkey.houstons.tech +short → No answer

Email provider: Forward Email (mx1.forwardemail.net)

Configure DKIM via Forward Email:

1. In Forward Email admin, navigate to Domain Settings → DKIM
2. Generate DKIM key pair
3. Add the CNAME or TXT record provided:
   fe-._domainkey.houstons.tech CNAME fe-._domainkey.forwardemail.net
4. Wait for DNS propagation (5-30 minutes)
5. Verify: dig TXT fe-._domainkey.houstons.tech +short

Response headers checked:
✗ Strict-Transport-Security: NOT FOUND

Headers present: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, X-XSS-Protection
Headers missing: Strict-Transport-Security, Content-Security-Policy, Permissions-Policy

Enable HSTS in Cloudflare:

1. Cloudflare Dashboard → SSL/TLS → Edge Certificates
2. Enable 'Always Use HTTPS'
3. Enable HSTS with settings:
   - max-age: 31536000 (1 year)
   - includeSubDomains: yes
   - preload: yes
4. Or add via Cloudflare Transform Rules:
   Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Content-Security-Policy: NOT FOUND
CSP Analysis: No policy detected

Header score: C (44%, 4/9 security headers present)

Add CSP via Cloudflare Transform Rules or origin server:

Basic policy:
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'

Start with Report-Only mode:
Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report

DNSBL Domain Checks:
✓ dbl.spamhaus.org — Not listed
✓ multi.surbl.org — Not listed
✗ black.uribl.com — LISTED

Note: IP DNSBL canary check returned 'blocked' — IP blacklist results unreliable from scan location.

1. Check listing status: https://admin.uribl.com/?section=lookup&domain=houstons.tech
2. If listed in error, submit removal request via URIBL admin panel
3. Review domain usage for any spam-associated content or links
4. Set up DNSBL monitoring (HetrixTools or UptimeRobot) to detect future listings
5. Ensure DMARC aggregate reports are reviewed for abuse patterns

MTA-STS Record: v=STSv1; id=20260109v01;
MTA-STS Mode: null (policy file not accessible or mode not set)
TLS-RPT: v=TLSRPTv1; rua=mailto:[email protected] (configured)

Ensure the MTA-STS policy file is accessible:

1. Create/verify: https://mta-sts.houstons.tech/.well-known/mta-sts.txt
2. Policy file content:
   version: STSv1
   mode: enforce
   mx: mx1.forwardemail.net
   mx: mx2.forwardemail.net
   max_age: 604800
3. Host on a subdomain mta-sts.houstons.tech with valid HTTPS
4. Update DNS record ID when policy changes

DNSSEC: Disabled
Registrar: Unknown (.tech TLD)
Nameservers: eleanor.ns.cloudflare.com, watson.ns.cloudflare.com

Enable DNSSEC via Cloudflare:

1. Cloudflare Dashboard → DNS → Settings
2. Click 'Enable DNSSEC'
3. Copy the DS record provided by Cloudflare
4. Add the DS record at your domain registrar
5. Wait 24-48h for propagation

Cloudflare handles key management and signing automatically.

CAA Records: None found
Current certificate issuer: Google Trust Services
CDN: Cloudflare (uses Google Trust Services for edge certificates)

Add CAA records in Cloudflare DNS:

1. Cloudflare Dashboard → DNS → Records
2. Add CAA records:
   houstons.tech CAA 0 issue "letsencrypt.org"
   houstons.tech CAA 0 issue "pki.goog"
   houstons.tech CAA 0 issuewild ";"
   houstons.tech CAA 0 iodef "mailto:[email protected]"

Note: Include pki.goog for Cloudflare's Google Trust Services certificates.

Permissions-Policy: NOT FOUND

Present headers: X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff), Referrer-Policy (same-origin), X-XSS-Protection (1; mode=block)

Add via Cloudflare Transform Rules:

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()

This disables all sensitive browser APIs unless explicitly needed.

HTTP Status: 525 (SSL Handshake Failed)
Cloudflare Ray: 9d7d5ca9a813329e-BNE
Edge Certificate: TLS 1.3 via Google Trust Services
Server Timing: cfEdge;dur=92,cfOrigin;dur=0 (origin returned immediately with error)

Fix origin SSL configuration:

1. Cloudflare Dashboard → SSL/TLS → Overview
2. Set encryption mode to 'Full' (not 'Full (strict)') if origin has self-signed cert
3. Or install a Cloudflare Origin CA certificate on the origin server
4. Or set to 'Flexible' if origin doesn't support SSL (less secure)
5. Verify: curl -vk https://origin-ip --resolve houstons.tech:443:origin-ip

TLSA Records: None found
Note: DANE requires DNSSEC to be enabled first (currently disabled).

After enabling DNSSEC (HST-006):

1. Generate TLSA record for MX servers
2. Add: _25._tcp.mx1.forwardemail.net TLSA 3 1 1 <hash>
3. Note: Forward Email manages their own DANE; check if they publish TLSA records
4. DANE is informational — focus on DNSSEC first

BIMI Record: Not found
_bimi.houstons.tech TXT → No answer
DMARC Policy: reject (prerequisite met)

1. Design a square SVG logo (Tiny 1.2 profile)
2. Obtain a VMC from DigiCert or Entrust (~$1,500/year)
3. Host the SVG and VMC at public HTTPS URLs
4. Add DNS record:
   _bimi.houstons.tech TXT "v=BIMI1; l=https://houstons.tech/bimi/logo.svg; a=https://houstons.tech/bimi/cert.pem"
5. Alternative: Some providers accept BIMI without VMC for testing

/.well-known/security.txt: Not accessible
Note: HTTP 525 may prevent access to .well-known resources.

Create /.well-known/security.txt:

Contact: mailto:[email protected]
Expires: 2027-03-06T00:00:00.000Z
Preferred-Languages: en
Canonical: https://houstons.tech/.well-known/security.txt
Policy: https://houstons.tech/security-policy

Host via Cloudflare Workers or origin server.

Sitemap: Not accessible
Sitemap URL count: 0
Robots.txt: Cloudflare managed content signals present
AI crawler blocks: ClaudeBot, GPTBot, CCBot, Bytespider, Google-Extended, etc.

If the site has public pages, create a sitemap.xml and reference it in robots.txt:

Sitemap: https://houstons.tech/sitemap.xml

HSTS Preload: Not enrolled
Note: HSTS header must be present first (see HST-002).

After configuring HSTS (HST-002) with preload directive:

1. Verify all subdomains support HTTPS
2. Submit at https://hstspreload.org/
3. Requirements: max-age ≥ 31536000, includeSubDomains, preload directive