Email dan DNS for WordPress
medium6 checks
Email authentication protects the brand, not the website. SPF, DMARC, DKIM, DNSSEC and CAA are cheap controls that stop spoofing and rogue certificates.
What WordPress must have
- SPF record ending in -all with every legitimate sender listed
- DMARC published, moving from p=none to quarantine then reject
- DKIM signing enabled on the mail provider
- DNSSEC signed at the registrar
- CAA record restricting which CAs may issue certificates
- MTA-STS and TLS-RPT for inbound mail
How to fix it
- 1Publish DMARC in monitoring mode first, then tighten after reviewing reports
- 2Add CAA for the CA you actually use, usually letsencrypt.org
WordPress context
PHP-based CMS powering ~43% of the web, extended through themes and plugins.
Core is rarely the weak point — outdated plugins, xmlrpc.php, user enumeration and exposed debug logs are. Also inherits every PHP runtime CVE.