Learn
What Surface checks.
Short, plain-language guides to each of the security controls Surface grades — what they do, why they matter, and how to get them right.
RFC 7489DMARCThe policy that tells mail servers what to do with mail that fails SPF and DKIM.RFC 7208SPFThe list of servers allowed to send mail as your domain.RFC 6376DKIMThe cryptographic signature that proves a message hasn't been altered since it was sent.RFC 4033–4035DNSSECCryptographically signs DNS answers so they cannot be forged in transit.W3C CSP Level 3Content-Security-PolicyThe response header that limits which scripts a browser will execute.RFC 6797HSTSTells the browser to never connect to your site over plain HTTP again.RFC 8659CAALimits which certificate authorities are allowed to issue certificates for your domain.RFC 8461 / 8460MTA-STS and TLS-RPTMakes other mail servers use encryption when delivering mail to you, and tells you when they cannot.RFC 5280TLS certificatesWhat makes a certificate trustworthy to a browser, and the ways a site gets it wrong.RFC 8996 / 8446TLS versionsWhy servers should accept TLS 1.2 and 1.3 only, and what is wrong with the older versions.W3C / WHATWGBrowser security headersSmall response headers that stop clickjacking, content sniffing and unwanted browser features.RFC 6265bisCookie flagsSecure, HttpOnly and SameSite: the three attributes that decide who can read or send a cookie.WHATWG FetchCORSHow a site lets other websites read its responses, and the settings that quietly give it away.RFC 7505 / 7208Domains that send no emailParked and web-only domains can still be spoofed. Here is how to shut that door.