Hacker News Reader

Comment by bhartzer | Hacker News Reader

I don’t see any mention of domain names. Domain names should be set up properly, like implementing dnssec, dmarc, dkim, spf, and using a secure registrar. So many overlook domain security.

View on HN

Implementing DNSSEC is definitely not a security best practice; virtually none of the best-regarded security teams have implemented it.

Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it.

Honestly, I thinks it’s a case that most people don’t know about it, so they don’t know to implement it. The same goes for DMARC as well.

> Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it

Unclear how it makes sense to do something allegedly security related that best-regarded security teams recommend against. Sounds like security theater.

Meanwhile, consider the failures: https://ianix.com/pub/dnssec-outages.html

Misconfiguation can cause the sites to disappear from the internet.

I haven’t seen any security teams recommend against implementing dnssec.

Interesting to see info about the failures, though. Thanks for pointing that out.

I’ve been running a ton of sites on domains with dnssec enabled and haven’t had any issues that I’m aware of.

The IETF has been trying to light a fire under organizations to deploy DNSSEC since 2008. You can take any list of popular domains --- last time I did this, I used the "Moz 500", whatever that is --- and write a simple shell loop around `host -t ds ${domain}" to see how many of those domains are signed. You'll see some! But they're overwhelmingly affiliated either with academia or with the US government, which, until 2017, mandated DNSSEC, but later rescinded the mandate.

DNSSEC has virtually no real-world commercial deployment. There have been years, I believe, when US deployment went down. It's dead. Let it lie.

I agree, we aren’t seeing as much implementation of dnssec, and a lot of other checks that when check the DNP Scores of domains.

I recently ran the DNP Scores of all domains of companies in the Fortune 500 and only about 8 percent had high scores, and we check for dnssec as part of the algorithm.

So less than 8 percent of the Fortune 500 have dnssec implemented.

(For transparency, I wrote the algo behind DNP Score.)

The numbers get even starker if you look at large tech companies, as opposed to companies across the entire F500. And large tech companies have the best security teams in the world. They've rejected DNSSEC. I'd remove it from your score; it's not a reflection of anything in the real world.

If you were to rewrite this list what are the 10 best things to do for a small company to do to protect themselves?

The principle of least privilege should be at play at every level. That can mean different things in in different technical contexts, but it’s universally applicable.

If you'll accept 7 things instead of 10, my answer to this is linked in the post (search for "seven things").

Unless they're rapidly editing this based on the thread you missed the mention. I currently see "Ensure that your domain names are protected" under "Your company." It doesn't really mention spoofing controls and deliverability, but does talk about registration and hijack prevention!

If you're hosting user content I always recommend hosting that on another domain.

There is plenty of prior art about this on hacker news. Example: https://news.ycombinator.com/item?id=25802366

DKIM increases your chances of getting mail into an inbox. There's no "negative signal", that is, a recipient has no way of knowing emails were meant to be signed and weren't.

I know you can provide indications with DMARC, but the usual thing is that if an email is SPF verified then it's considered legitimate even when not signed. Accordingly, DKIM can help land emails but only helps security in the unusual situation where you're trying to argue something in an inbox definitely came from you.

What's a good secure registrar?

I can tell you which ones not to use based on which registrars have had domain names stolen frequently.

That helps as well.

Cloudflare, but you can’t register with them, only transfer in. I buy at Namecheap, and then transfer in.

Edit: Based on Austin’s below reply it looks like you can register directly with Cloudflare now. Thanks Austin!

You actually can register with them and they promise to provide registration at cost forever: https://www.cloudflare.com/products/registrar/

Note: They released the beta fairly recently, which is why a lot of folks don’t know about it yet.

Any resources on this?

https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop... is a pretty good primer on spoofing (SPF, DKIM, DMARC)

Reply on news.ycombinator.com