Step-by-step instructions for fixing the issues found by the QShield Security Checkup. Click any section below to jump straight to the guide you need.
Sender Policy Framework (SPF) is a DNS TXT record that tells receiving mail servers which IP addresses and hosts are allowed to send email on behalf of your domain.
Why it matters: Without SPF, anyone can forge emails that appear to come from your domain. SPF is the first layer of email authentication and is required by most mail providers and cyber insurance policies.
include:_spf.google.com with the SPF include for your email provider:
include:_spf.google.cominclude:spf.protection.outlook.cominclude:zoho.cominclude: directives into a single TXT record.+all — this allows anyone to send as your domain. Always use ~all (soft fail) or -all (hard fail).include:, a, mx, and redirect counts as a lookup.DomainKeys Identified Mail (DKIM) adds a cryptographic signature to every outgoing email. Receiving servers verify the signature against a public key published in your DNS, confirming the message hasn't been tampered with and genuinely came from your domain.
Why it matters: DKIM prevents email spoofing and tampering in transit. Without it, attackers can modify your emails or impersonate your domain. It's also required for DMARC alignment.
google, selector1) is unique to your provider.Domain-based Message Authentication, Reporting & Conformance (DMARC) ties SPF and DKIM together. It tells receiving servers what to do when an email fails authentication — and where to send reports about it.
Why it matters: DMARC is the only way to instruct the world to reject forged emails from your domain. Without it, phishing emails using your domain can reach inboxes even if you have SPF and DKIM configured.
p=none — Monitor only. Emails that fail are still delivered but you receive reports. Start here.p=quarantine — Failed emails are sent to spam/junk.p=reject — Failed emails are blocked entirely. The goal.dmarc-reports@yourdomain.com with an email address where you want to receive aggregate reports.p=none → p=quarantine → p=reject.
adkim=s and aspf=s enforce strict alignment — the From domain must exactly match the SPF/DKIM domain.
DNS Security Extensions (DNSSEC) adds cryptographic signatures to your DNS records, allowing resolvers to verify that responses haven't been tampered with during transit.
Why it matters: Without DNSSEC, attackers can perform DNS spoofing (cache poisoning) to redirect your visitors to malicious sites or intercept email. DNSSEC ensures the DNS answers your users receive are authentic.
Certificate Authority Authorization (CAA) is a DNS record that specifies which Certificate Authorities (CAs) are allowed to issue SSL/TLS certificates for your domain.
Why it matters: Without a CAA record, any CA in the world can issue a certificate for your domain. CAA prevents unauthorized certificate issuance, a technique used in man-in-the-middle attacks.
letsencrypt.orgdigicert.comsectigo.compki.googiodef record to receive notifications of unauthorized issuance attempts:
An SSL/TLS certificate encrypts the connection between your visitors' browsers and your web server, protecting data in transit from eavesdropping and tampering.
Why it matters: Without HTTPS, login credentials, form data, and browsing activity are transmitted in plain text. Browsers also display "Not Secure" warnings to visitors, damaging trust. SSL is mandatory for PCI compliance, SEO ranking, and cyber insurance.
HTTP Strict Transport Security (HSTS) is a response header that tells browsers
to always use HTTPS when connecting to your site — even if the user types http://.
Why it matters: Without HSTS, the first request to your site may go over plain HTTP before being redirected, leaving a window for man-in-the-middle attacks. HSTS eliminates this by instructing browsers to never attempt an insecure connection.
Nginx:
Apache (.htaccess or config):
Cloudflare:
SSL/TLS → Edge Certificates → Enable HSTS. Set max-age to 12 months and enable includeSubDomains.
max-age (e.g. 300 = 5 minutes) to test, then increase to 31536000 (1 year).includeSubDomains applies to all subdomains — make sure they all support HTTPS.HTTP security headers are response headers that instruct browsers to enable built-in security features, protecting your visitors from cross-site scripting (XSS), clickjacking, MIME sniffing, and other attacks.
Why it matters: Security headers are a low-effort, high-impact defense layer. They cost nothing to implement and protect against some of the most common web attacks.
X-Content-Type-Options — Prevents MIME type sniffing:
X-Frame-Options — Prevents clickjacking by blocking iframing:
X-XSS-Protection — Enables the browser's XSS filter (legacy, but still recommended):
Referrer-Policy — Controls how much referrer information is shared:
Permissions-Policy — Restricts browser features (camera, mic, geolocation):
Content-Security-Policy (CSP) — Controls which resources the browser can load. Start with a report-only policy:
Nginx — add to your server block:
Apache (.htaccess):
Cloudflare: Use Transform Rules (Modify Response Header) to add each header, or deploy them on your origin server.
Still need help? Run a free scan to see exactly what needs fixing.
Run Free Security Checkup