SecuTest knowledge base

From security finding to verified remediation

Each guide explains the finding, associated attack or failure scenario, remediation procedure and external verification workflow.

Scan a domain Domain Security Assessment Email Security Assessment

49 scored controls

Security remediation guides

Use the check ID from a SecuTest report to locate its specific operational guide.

Attack surface

1 guides

Attack surface Sensitive exposed services Internet-reachable administrative, database, file-sharing, or remote-access services can be brute-forced, exploited, or abused when exposure is unnecessary or weakly controlled. Open remediation guide →

Certificate security

2 guides

Certificate security CAA issuance policy An absent or overly broad CAA policy provides no DNS-level restriction on which certificate authorities may issue for the domain. Open remediation guide → Certificate security CAA record syntax Malformed CAA records may be ignored or produce issuance behavior different from the intended certificate-authority policy. Open remediation guide →

DNS security

4 guides

DNS security DNSSEC algorithm strength Deprecated DNSSEC algorithms reduce cryptographic assurance and may fail modern resolver or policy requirements. Open remediation guide → DNS security DNSSEC validation Broken DNSSEC can make a signed domain unreachable to validating resolvers, while an unsigned zone lacks cryptographic authenticity for DNS answers. Open remediation guide → DNS security Dangling DNS records A DNS record pointing to a retired or unresolved external dependency can break services and may become a subdomain-takeover path if the resource is claimable. Open remediation guide → DNS security Subdomain takeover risk A claimable third-party target can let an attacker publish content and abuse trust under the organization's domain. Open remediation guide →

Email security

25 guides

Email security DKIM CNAME chain A broken, looping, or excessively long DKIM CNAME chain can prevent receivers from retrieving the signing key. Open remediation guide → Email security DKIM public key presence A selector record without an active public key cannot validate signatures and may represent an incomplete or unintended revocation. Open remediation guide → Email security DKIM public key strength A weak DKIM key may not provide adequate resistance to key recovery or signature forgery over its operational lifetime. Open remediation guide → Email security DKIM record syntax Malformed DKIM tags can make a published key unusable and cause signature verification failures. Open remediation guide → Email security DKIM testing flag Leaving `t=y` enabled in production can signal that verification failures should be treated less strictly than intended. Open remediation guide → Email security DMARC aggregate reporting Without aggregate reporting, the organization loses visibility into legitimate authentication failures and unauthorized use of its domains. Open remediation guide → Email security DMARC enforcement percentage A `pct` value below 100 intentionally leaves part of failing mail outside the requested enforcement policy. Open remediation guide → Email security DMARC enforcement policy A monitoring-only `p=none` policy records abuse but does not ask receivers to quarantine or reject unauthenticated direct-domain mail. Open remediation guide → Email security DMARC record presence Without DMARC, the visible From domain has no published alignment and handling policy, increasing exposure to direct-domain spoofing and phishing. Open remediation guide → Email security DMARC subdomain policy A weaker `sp` policy can leave unused or forgotten subdomains available for spoofing even when the organizational domain enforces DMARC. Open remediation guide → Email security Duplicate DKIM records Multiple conflicting DKIM records for one selector can make key retrieval ambiguous and cause signature verification failures. Open remediation guide → Email security Null MX configuration An invalid or mixed Null MX declaration creates contradictory mail-routing instructions and can cause delivery failures or unintended fallback behavior. Open remediation guide → Email security Resolvable DKIM selector A configured DKIM selector that does not resolve prevents receivers from retrieving the public key needed to verify signatures. Open remediation guide → Email security Resolvable MX targets An MX target that does not resolve cannot receive mail and may indicate stale infrastructure or, in some provider-specific cases, a takeover opportunity. Open remediation guide → Email security SPF DNS lookup limit Exceeding SPF's ten DNS-lookup limit causes a permanent error, breaking authentication for messages that reach the excessive path. Open remediation guide → Email security SPF PTR mechanism The deprecated SPF `ptr` mechanism is slow, fragile, and can authorize hosts based on reverse-DNS relationships that are difficult to control and audit. Open remediation guide → Email security SPF all mechanism policy A missing, neutral, soft, duplicated, or permissive `all` mechanism can authorize unintended senders or leave spoofing decisions weak. Open remediation guide → Email security SPF include and redirect recursion Broken, circular, missing, or excessively deep SPF dependencies can produce permanent errors and invalidate sender authorization. Open remediation guide → Email security SPF record presence Without SPF, receivers have no domain-published list of authorized envelope senders, increasing exposure to email spoofing and phishing. Open remediation guide → Email security Single DMARC record Multiple DMARC records make the policy invalid, so receivers cannot reliably enforce the intended anti-spoofing controls. Open remediation guide → Email security Single SPF record Publishing multiple SPF records causes a permanent SPF error, disabling reliable sender authorization and potentially harming delivery. Open remediation guide → Email security Valid DKIM public key An invalid DKIM public key cannot verify message signatures and can break DMARC for senders that rely on DKIM alignment. Open remediation guide → Email security Valid DMARC syntax Invalid DMARC tags, values, ordering, or reporting URIs can invalidate the policy and prevent reliable enforcement or reporting. Open remediation guide → Email security Valid MX record syntax Malformed MX records can make inbound mail delivery unreliable or impossible and may send mail systems down unintended fallback paths. Open remediation guide → Email security Valid SPF syntax Invalid SPF mechanisms, modifiers, qualifiers, or ordering can produce a permanent error and make the policy unusable. Open remediation guide →

Reputation

2 guides

Reputation Domain blocklist reputation A confirmed domain blocklist listing can cause mail rejection, browser or security-product warnings, and loss of trust, and may indicate phishing, malware, spam, or a compromised web property. Open remediation guide → Reputation IP blocklist reputation A confirmed public-IP blocklist listing can disrupt email delivery and may indicate spam, malware, open-proxy abuse, compromised accounts, or an infected workload. Open remediation guide →

Transport security

6 guides

Transport security Modern TLS protocol version Negotiating an obsolete or unknown TLS version exposes clients to deprecated protocol behavior and weakens compliance with modern security baselines. Open remediation guide → Transport security Obsolete TLS protocols Support for TLS 1.0 or TLS 1.1 exposes clients to obsolete protocol behavior, weak cryptographic combinations, downgrade opportunities, and compliance failures. Open remediation guide → Transport security TLS certificate expiration An expired or soon-to-expire certificate can cause a production outage, train users to bypass warnings, and weaken confidence in server identity. Open remediation guide → Transport security TLS certificate validation An untrusted, incomplete, expired, or hostname-mismatched certificate prevents clients from authenticating the server and encourages dangerous warning bypasses. Open remediation guide → Transport security TLS service availability An unavailable or invalid TLS service prevents clients from establishing a protected connection and may push users toward insecure alternatives. Open remediation guide → Transport security Weak TLS cipher suites Accepted NULL, EXPORT, anonymous, RC4, DES, 3DES, or MD5-based suites can remove authentication or materially weaken confidentiality and integrity. Open remediation guide →

Web security

9 guides

Web security Clickjacking protection Without `frame-ancestors` or a valid X-Frame-Options value, another site may frame the application and trick users into interacting with hidden controls. Open remediation guide → Web security Content Security Policy A missing or permissive CSP does not create XSS by itself, but it removes a major defense that can limit script injection and data exfiltration. Open remediation guide → Web security HTTP Strict Transport Security Missing, disabled, malformed, or short-lived HSTS leaves browsers able to make an insecure first or later HTTP request. Open remediation guide → Web security HTTP to HTTPS redirect Serving HTTP without a clear same-site HTTPS redirect leaves first visits exposed to interception, downgrade, and content injection. Open remediation guide → Web security HTTPS availability Without a retrievable HTTPS response, web traffic cannot rely on transport confidentiality, integrity, and authenticated server identity. Open remediation guide → Web security Permissions Policy Without a Permissions-Policy, pages and embedded content may access browser features more broadly than the application requires. Open remediation guide → Web security Referrer Policy A missing or permissive Referrer-Policy can disclose internal paths, query values, or origin information to third-party destinations. Open remediation guide → Web security Server software disclosure Server and framework identification headers provide reconnaissance data that can help attackers prioritize known exploits and tailor probes. Open remediation guide → Web security X-Content-Type-Options Without `X-Content-Type-Options: nosniff`, browsers may interpret a response as executable content despite an incorrect declared MIME type. Open remediation guide →