News for hackers. Stuff that matters.

A comment on Security 101 for SaaS startups.

Re:Security 101 for SaaS startups by _wmd on Sunday March 05, 2017 @05:58PM (#13799379)
SPF and DKIM can be applied just fine to subdomains, I don't understand the suggestions made for email, yet there are good reasons to have a few extra domains, none which are actually mentioned: accidental cookie leakage and redundancy being obvious ones. The implication made for the API domain was that it should not be protected by SPF and DKIM

I stopped reading there

[ Parent | on HN ]
Re:Security 101 for SaaS startups by itaifrenkel on Sunday March 05, 2017 @11:19PM (#13800670)
My understanding was that SPF and DKIM are only for sending emails.

I need to rearrange that paragraph and add the 2 other reasons you mentioned, and you are right that outgoing emails are better sent from subdomains.

I do wonder though if a spam filter blocks x.d.com would it also block emails from d.com?

[ Parent | on HN ]
Re:Security 101 for SaaS startups by itaifrenkel on Friday March 10, 2017 @11:41AM (#13839863)
hi. Here is my attempt to clarify this section. Could you please comment on PR https://github.com/forter/security-101-for-saas-startups/pul... ?
[ Parent | on HN ]