Email dan DNS for Spring Boot
medium6 checks
Email authentication protects the brand, not the website. SPF, DMARC, DKIM, DNSSEC and CAA are cheap controls that stop spoofing and rogue certificates.
What Spring Boot must have
- SPF record ending in -all with every legitimate sender listed
- DMARC published, moving from p=none to quarantine then reject
- DKIM signing enabled on the mail provider
- DNSSEC signed at the registrar
- CAA record restricting which CAs may issue certificates
- MTA-STS and TLS-RPT for inbound mail
How to fix it
- 1Publish DMARC in monitoring mode first, then tighten after reviewing reports
- 2Add CAA for the CA you actually use, usually letsencrypt.org
Spring Boot context
Java application framework with auto-configuration and embedded servers.
Actuator endpoints leak heap dumps and environment variables when exposed; restrict /actuator.