This talk I will go over some FOS (online) tooling to check your mail config. Some common misconfigurations in DNS. Why you should probably want to avoid www CNAME @, and how to config other observations from the biannual measurements of scanning more than 10.000 governmental host names in The Netherlands. After this talk you'll know at least one DNS or security improvement for your own or organization domain, or something to monitor for your email.

Online tools: - the free open source Internet.nl (in the project team) [IPv6, DNSSEC, SPF, DMARC, DKIM, STARTTLS, DANE inbound] - the free open source haveDANE.net (adopted/hosted by platform behind internet.nl) [interactive DANE outbound] - the free open source zonemaster.net [DNS] - the free open source DNSViz.net [DNS]

Run yourself: - the free open source spftrace [SPF] - the free open source testssl.sh [STARTTLS]

And a split second for some links to non FOS tooling that is useful, and maybe be made open source (there is no sell of a product nor ads), or should be re-created: - https://www.email-security-scans.org - https://www.huque.com/bin/danecheck-smtp - https://dane.sys4.de

(Free but commercial that needs a FOS alternative: https://www.mail-tester.com & https://emailspooftest.com)

In 2025 I gave a 45 minute talk on WHY2025 How (not) to configure your domainname [internet.nl] (recording) about internet standards / misconfigurations in both website and email space. In this talk I want to focus on the mail part and (online) free open source tooling to check your mail config.

This presentation will touch on: - DNSSEC (RFC 4033 and many more), some common failures (e.g. CNAME's) - why not CNAME to your apex domain (if you have an Mx record) - use Null MX (RFC 7505) (if you don't use mail on a hostname) - why configuration SPF (RFC 7208) on all hostnames - why there are more reasons to avoid CNAME's - why enable DANE (RFC 6698) and TLSRPT (RFC 8460) and why it's superior to MTA-STA (RFC 8461), how to rotate DANE - why monitoring matters (IPv6, DANE, SPF, etc.)