Editing Marcotrix.xyz Reconnaissance Report (section)

=== Medium Priority ===

==== Add HSTS ====

Finding:

* HSTS was not configured on tested HTTPS names.

Recommendation:

Start conservatively:

<pre>
Strict-Transport-Security: max-age=86400
</pre>

Move to a long-lived policy after confirming all subdomains are HTTPS-ready:

<pre>
Strict-Transport-Security: max-age=31536000; includeSubDomains
</pre>

Only use <code>preload</code> if all subdomains are intended to be permanently HTTPS-only.

==== Fix <code>money.marcotrix.xyz</code> TLS/backend configuration ====

Finding:

* HTTP redirects to HTTPS.
* HTTPS fails with a TLS internal error.

Recommendation:

* Check Caddy site block and certificate state for <code>money.marcotrix.xyz</code>.
* Confirm backend availability.
* Remove DNS/cert automation for the hostname if unused.

==== Harden email DNS ====

Current:

<pre>
SPF:   v=spf1 mx ~all
DMARC: v=DMARC1; p=none; rua=mailto:mail@marcotrix.xyz
</pre>

Recommendations:

* Move SPF from softfail to hardfail once valid senders are known:

<pre>
v=spf1 mx -all
</pre>

* Move DMARC from monitoring to enforcement after reports are clean:

<pre>
v=DMARC1; p=quarantine; rua=mailto:...
v=DMARC1; p=reject; rua=mailto:...
</pre>

* Add MTA-STS and TLS-RPT if receiving mail:

<pre>
_mta-sts.marcotrix.xyz TXT "v=STSv1; id=YYYYMMDD01"
_smtp._tls.marcotrix.xyz TXT "v=TLSRPTv1; rua=mailto:tlsrpt@marcotrix.xyz"
</pre>

==== Add CAA ====

Finding:

* No CAA record was observed.

Recommendation:

If Let's Encrypt is the only intended CA:

<pre>
marcotrix.xyz. CAA 0 issue "letsencrypt.org"
marcotrix.xyz. CAA 0 issuewild ";"
</pre>

Adjust this if other CAs are intentionally used.

==== Consider DNSSEC ====

Finding:

* RDAP reports DNSSEC unsigned.

Recommendation:

* Enable DNSSEC at the DNS provider if operationally comfortable.