Site security, part 2: DNSSEC and fake email

In the previous post I wrote about the lock: always HTTPS, TLS 1.2 as the minimum, and HSTS. This part is different. Now the subject is the site’s name.

What I wanted to solve

On 3 October 2026 the personal site went live at rodrigoesporto.com. The lock protects the path of the page. I still wanted to protect the name. Nobody sending the visitor to a fake site. Nobody sending email pretending to be the site. Nobody issuing a certificate I did not ask for.

I work during the day, and at night and on Sundays I build with AI agents. In the Cloudflare panel, I clicked. Darth checked from outside. Darth is the main bot: it takes any request and sends it to the right agent.

I use Cloudflare. I pay them for the domain. I am not reviewing the company from the outside. I am telling you about the second block I turned on in the panel.

Quick summary

• I turned on DNSSEC: a signature on the address, so nobody sends the visitor to a fake site.
• I published records against fake email, telling the world that the domain does not send email. On internet.nl, the email part scored 100%.
• I turned on CAA: only authorized companies can issue a security certificate for the domain.
• I turned on Bot Fight Mode: it blocks malicious bots.
• Anyone who types www.rodrigoesporto.com goes to rodrigoesporto.com, with code 301 (“permanent change”), and the rest of the address stays.

First: what DNSSEC is

DNS is the internet’s address catalog. You type a name, the catalog answers where the site lives. DNSSEC is a signature on that catalog. The full name is Domain Name System Security Extensions. In everyday language: the address comes with a seal, so nobody swaps the sign on the door.

Anyone can swap a business card at a reception desk. Same name, different path. A seal lets you check whether the note is still the original. What DNSSEC does: the catalog’s answer comes signed. If someone on the way swaps the answer, the signature does not match.

A paper seal you inspect with your eyes. Here the device does a calculation, and the visitor does not notice. DNSSEC authenticates the name. It does not read the page.

What protection against fake email is

Records against fake email are public notices on the domain. They tell the world whether that name sends mail or not. In my case, the notice is this: this domain does not send email.

Picture an office with no outgoing letters. If nobody says so, a scammer writes with the name from the facade. If the office puts a note at the desk (“no letters leave here”), the post on the other end has something to check. In practice, those records sit in the domain catalog, in public. Email systems look at them before treating a message as if it came from there.

The desk note does not stop every scam. Someone can still write a message that only looks like it came from me, using another address. The lesson: even a domain that does not send email needs to tell the world. Silence helps the impersonator.

What CAA is

CAA is a list of who may issue the security certificate for that name. The full name is Certification Authority Authorization. Certificate, here, is the digital paper behind the lock. A certificate authority is the company that issues that paper.

It is writing down who may copy the shop key. A public record on the domain says which companies may issue a certificate for that name. The others should not issue one.

A door key you hold in your hand. A certificate is a file the browser checks without you seeing it. CAA does not lock the page. It limits who can sign the name. I will not list companies or the text of the record.

What Bot Fight Mode is

Bot Fight Mode is a Cloudflare switch that blocks malicious bots. Bot, here, is not the assistant I use to write. It is a program that visits the site on its own. Malicious, in this case, means it knocks on the door to abuse the site, not to read it.

A doorman turns away machines that arrive like an attack. Cloudflare tries to tell a visit from a bad bot and blocks the second. I will not invent the test it uses. I do not have, in this part, a number for how many were blocked. It is an automatic rule, on the way to the page. It does not replace the rest of the security.

What the www redirect is

www is an old prefix, from “World Wide Web.” Plenty of people still type www in front of the name. A redirect is the site answering: the right address is the other one. Code 301 means “permanent change.” In my case, anyone who types www.rodrigoesporto.com goes to rodrigoesporto.com, and the rest of the address stays.

Two doors to the same shop confuse people. The 301 is the sign that says “the front door is this one, and it is for good.” The browser asks for the www version, the site answers 301, and the version without www opens with the rest of the path. The shop did not move buildings. The 301 stops the site from living under two names. It is not security in the lock sense.

The internet.nl test

internet.nl is a public test. It looks, among other things, at whether a domain is set up well for email. The address: https://internet.nl.

You put in the domain name and the service returns scores by section. In my case, the email part scored 100%. That score speaks to the mail notice, not to the whole picture of the site’s security.

That score went into the security review by the Segurança agent, on 3 October 2026. Segurança is the agent that checks every day, from outside, whether the site is still safe, without touching anything.

What I used

I used the Cloudflare panel. I used the domain rodrigoesporto.com, already live. I used Darth to check from outside while I clicked. I used the Segurança agent for the 3 October 2026 review. I used the internet.nl test on the email part.

Login, password, account screens, and the text of the records stay out of this text.

How it went

If you want to copy the design, the path is this:

1. Have the site live at your own address. In my case, that had already happened.
2. In the panel, turn on DNSSEC. When it works, the address starts to travel with a signature.
3. Publish the records against fake email. In my case, the notice is that the domain does not send mail.
4. Turn on CAA: only authorized companies issue a certificate for the domain.
5. Turn on Bot Fight Mode. When it works, malicious bots find a closed door.
6. Redirect www to the main address with code 301, keeping the rest of the path.
7. Check from outside. I clicked. Darth checked from outside.
8. Look at the email part on internet.nl. In my case, it scored 100%.

I will not invent the panel screen. What matters is the design: I click, someone checks from outside, the site’s name stops being a loose card at reception.

What went wrong, or what I learned

This time I do not have an error message from these switches to tell. What I have is the habit of not skipping the site’s name because “I do not send email anyway.”

DNSSEC, CAA, and mail records sound like jargon. The lesson for someone starting out is different: silence on the domain becomes room for impersonation. Even a personal site, one that does not send email, needs to say so to the world.

None of these tools replace judgment. They shorten the path between “I know what I want” and “it is live.” They protect the name.

Costs and limits

In this part I do not have an extra money cost to point to. I used the Cloudflare panel, on the domain I already pay for. I will not invent how long the clicks took either.

What this does not do: it does not make the content true, it does not replace the check from outside, and it does not cover the rest of the site’s security. The 100% on internet.nl is the email part, not everything. Bot Fight Mode blocks malicious bots; I have no block count to show.

I use Cloudflare and I pay them for the domain. The email score came from internet.nl, in the Segurança review, not from a company ad.

What I would do differently

I would not leave it as “I will look at the domain email later,” just because the site does not send letters. I do not have, in this part, a case where someone pretended to be the site. It is the habit I want: say what the domain does, and what it does not.

Who it is for, and who it is not for

It is for someone who put a personal site live and has not dealt with the name yet: signature on the address, email notice, who issues the certificate, bots, and www. It is for you if the host offers these switches in the panel, the way Cloudflare does in my case.

It is not a security course. It is not for you if you need a report for a company. It is not for someone who wants the agent to click instead of them: I clicked; Darth checked from outside; Segurança keeps checking from outside, without touching anything.

Closing

The visitor deserves to land at the right address, without fake email using the site’s name. DNSSEC, the records against fake email, CAA, Bot Fight Mode, and www with a 301 take care of that piece. On internet.nl, the email part scored 100%.

The next step, if your site is already live, is to look at the name: the domain says what it does, and www does not become a second site. If you want to follow the rest of this journey, I am on X: @RodrigoesPorto.

In the next part I cover site security, part 3: security headers and CSP.

Sources and links

• internet.nl test: https://internet.nl
• Security review by the Segurança agent, 3 October 2026
• Cloudflare panel, on the DNSSEC, fake-email records, CAA, Bot Fight Mode, and www redirect switches