Email dan DNS for BigCommerce
medium6 checks
Email authentication protects the brand, not the website. SPF, DMARC, DKIM, DNSSEC and CAA are cheap controls that stop spoofing and rogue certificates.
What BigCommerce must have
- SPF record ending in -all with every legitimate sender listed
- DMARC published, moving from p=none to quarantine then reject
- DKIM signing enabled on the mail provider
- DNSSEC signed at the registrar
- CAA record restricting which CAs may issue certificates
- MTA-STS and TLS-RPT for inbound mail
How to fix it
- 1Publish DMARC in monitoring mode first, then tighten after reviewing reports
- 2Add CAA for the CA you actually use, usually letsencrypt.org
BigCommerce context
Hosted SaaS commerce platform with theme-level customisation.
Stored XSS usually arrives through custom theme templates and third-party apps.