Hardening unused (sub)domains | Hacker News Reader

Hardening unused (sub)domains

mailhardener.com

239 pointsPhemist28 comments

Speaking of un-used domains, I had ~50 or ~60. I didn't like the old domain parking tools, so I created my own

It creates a content-aggregator site for your domain based on keywords important to your domain with a bunch of features related to building the traffic, monetizing etc.

But I digress. One of the features that I built was to allow users to send and receive emails using the domain names. This became an important feature once the site grows to become a bit more like a community (where users are submitting posts, comments etc) and there needs to be a way to engage with the userbase. It's also important for people who want to sell your domains.

The two specific features I built was

1) Using your existing GMail to send and receive emails with your custom domain 2) Forwarding your email to another inbox.

The email hardening advice given in this post is great - I've also added some of these and allow users to make changes to their DNS records directly.

Digressing into your https://newsy.co digression:

What's your opinion on using ActivityPub? It would be so much easier if I could interact with the content without having to create a new account.

It also seems to be a missed opportunity that you only show some sites. Why don't you have a catalogue of all sites, with the opportunity of treating this like a social network?

GOV.UK has similar recommendations since 2016: https://www.gov.uk/guidance/protect-domains-that-dont-send-e...

Thanks! We also found this one - but it is quite checklist-like and doesn't explain deeply what the individual settings mean (e.g. for user experience)

OP here. Company I work for recently changed names (and thus domains). This article was a godsend in realizing how important the old domain name still is. Thought I'd share!

Thanks! I already do most of this for unused domains, but was not aware of null MX records.

Null MX should really be top of the list - this was what was least known for us as well.

It is not necessarily mentioned in the article, but what became apparent while reading it (for us) is really what a long-term commitment a single domain name can be. Even though my company switched names, I think they will have to keep ownership of the previous domain name till... ermm.. possibly eternity?

i mean say the company lasts 100 years... < 2000 bucks is not that much money in the grand scheme of a long running company

How will the tech-priests running the future companies know to keep the domain names related to the company's name 5 changes back?

The cost paid to the domain registation service is only a small part of this equation.

Eternity might be overstated, because old accounts tied to old domains will surely lose their utility at some point and the potential for phishing goes down as the old names are forgotten by the public. Although it would be interesting to know what shenanigans can be had at Chiquita if one were to start mailing from unitedfruitcompany.com

Great tip, thanks for sharing.

This is a good idea. I use a catch-all domain for receiving mail. I never thought to set up DMARC & SPF until I received an email from a scammer attempting to impersonate the domain, but not any of the names I've used. I wonder also if it could impact the reputation/value of parked domains.

The article didn't mention Google's PostMaster tools:

https://gmail.com/postmaster/

This can give you a hint if your non-mail domain is being used elsewhere. I think it goes back 90-ish days, even before you had it set up.

I wonder if the default policy shouldn't be rejecting all email unless DMAR/SPF/DKIM is set up. I mean, email clients already mark non-authenticated emails as dangerous, that helps.

Just learnt of postmaster.google. Most useful information today. Thank you.

"No data to display at present. Please come back later."

I have never ever seen anything but this - given they are very low volume domains I assume this means they are not being abused (although the dmarc reports for at least one of them have 5-10 rejected attempts each day)

It's RFC 7505, not RFC 7575.

https://www.rfc-editor.org/rfc/rfc7505

Yep, that was a typo, it's fixed now. Thanks!

A related article from the UK gov: https://www.gov.uk/guidance/keeping-your-domain-name-secure

(they also have one to harden mails, OP: https://www.gov.uk/guidance/securing-government-email)

Regarding DKIM, Cloudflare recommends[1] a record of "v=DKIM1; p=", whereas this recommends deleting all "_domainkey" records. Is there a difference?

[1] https://www.cloudflare.com/learning/dns/dns-records/protect-...

"v=DKIM1; p=" is a perfectly valid DKIM record. It simply tells that the key has been revoked and you should no longer trust new emails signed with previous keys. The practical effects should be similar, although maybe there's a non-compliant server that retroactively revokes older emails (this should not happen, but I can only speculate).

I wish there was a one click way to set this up in my domain registrar. I’d pay a few dollars a year per domain too.

Cloudflare can do this. Even for domains you don't buy there. You can use a free account. Their Security Center scans warn you of this and other configuration issues you may not consider.

Edit: Sorry, you did say "one click way." I meant the warning of these things can be done on a free account, but the actions taken can only be done on a domain bought through CF. I don't think there can be a "one click way" for this type of change because a misconfiguration can have a huge impact on your business if you're not careful.

I use cloudron on as part of my self hosted stack. During the process of standing it up I also had to stand up Google DNS. My domain registar is also Google. but anyways, I had to set up a service account and keys to allow cloudron to make DNS changes. So if it can do it, I imagine it just depends on your DNS / nameservers and their API and features.

There is a standard called Domain Connect [0] that attempts to achieve this.

Mailhardener will auto-detect Domain Connect and offer it automatically for 1-click configuration, but your DNS service provider has to support it.

[0] https://www.domainconnect.org/

Not exactly one-click, but define your DNS records in Terraform and copy them for each domain.

Seems like the easiest solution is to just make them real email domains and have them forward to your main one. With fastmail I just have all of my domains forwarding to one inbox and I send from one particular one.

A terraform module would be nice.

Check this internet.nl how-to on parked domains: https://github.com/internetstandards/toolbox-wiki/blob/main/...

I also wrote a similar (shorter) article a few months ago after a customer complained that they received a phishing email from me:

https://www.uxwizz.com/blog/stop-others-use-your-domain-emai...

Reply on news.ycombinator.com