Ensure Either SPF or DKIM DNS Records are Configured

低等級 2人工審核bind

說明

For each authoritative domain that receives SMTP email, add either an SPF (Sender Policy Framework) TXT record and/or add a DKIM (DomainKeys Identified Mail) TXT record. Manual review: the check needs remote queries, architecture knowledge or site policy.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

For each authoritative domain, perform the following: ; Check the domain for an MX record to verify that the domain receives SMTP email. If there no MX record, then the domain is considered compliant. The following host command will query the localhost DNS server for any MX records for the given domain. The output below shows a domain that does not have an MX record. $ host -t mx example1.com 127.0.0.1 . . . example1.com has no MX record For domains which have an MX record, perform the following two tests to audit compliance. If either test passes, the domain is considered compliant.

修補方式

修補方法: 操作指南或基礎設施修補檔

Add either an SPF TXT record and/or a default DKIM TXT record to the domains with the appropriate values. The SPF record should have a soft fail policy of ~all or a strict policy of -all There are on-line resources and tools such as MX toolbox that will help in generating and testing SPF, DKIM and DMARC records as shown in the references.

屬性

作業系統: 不限
標籤: binddnsdnssec
參考資料: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 7.4 Ensure Either SPF or DKIM DNS Records are Configured