Email dan DNS for OpenResty
medium6 checks
Email authentication protects the brand, not the website. SPF, DMARC, DKIM, DNSSEC and CAA are cheap controls that stop spoofing and rogue certificates.
What OpenResty must have
- SPF record ending in -all with every legitimate sender listed
- DMARC published, moving from p=none to quarantine then reject
- DKIM signing enabled on the mail provider
- DNSSEC signed at the registrar
- CAA record restricting which CAs may issue certificates
- MTA-STS and TLS-RPT for inbound mail
How to fix it
- 1Publish DMARC in monitoring mode first, then tighten after reviewing reports
- 2Add CAA for the CA you actually use, usually letsencrypt.org
OpenResty context
Nginx bundled with LuaJIT for programmable edge logic.
Lua handlers execute per request; validate every header before using it in logic or logs.