DNS hijacking (Prevention) Guide 3 Apache Server

Here is a full Apache configuration example with SSL/TLS, HTTP security headers, and email security protocols:

Apache Configuration (HTTP Security Layers)

Add this configuration to the Apache virtual host file for HTTPS (typically located in /etc/apache2/sites-available/):

<VirtualHost *:443>
    ServerName example.com

    # SSL/TLS Configuration
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
    SSLHonorCipherOrder on

    # HSTS (HTTP Strict Transport Security)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # X-Content-Type-Options to prevent MIME-type sniffing
    Header always set X-Content-Type-Options "nosniff"

    # X-Frame-Options to prevent clickjacking
    Header always set X-Frame-Options "DENY"

    # X-XSS-Protection to enable XSS filtering
    Header always set X-XSS-Protection "1; mode=block"

    # Content Security Policy (CSP)
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'"

    DocumentRoot "/var/www/example.com"
    <Directory "/var/www/example.com">
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

Email Security Protocols (SPF, DKIM, DMARC)

Configure the following DNS records with your domain provider:

1. SPF Record:

   Record Type: TXT
   Name: @
   Value: "v=spf1 include:_spf.example.com -all"
   

2. DKIM Record: Generate a DKIM key pair and add the public key to DNS:

   Record Type: TXT
   Name: selector._domainkey.example.com
   Value: "v=DKIM1; k=rsa; p=public_key_here"
   

3. DMARC Record:

   Record Type: TXT
   Name: _dmarc.example.com
   Value: "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=s; aspf=s"
   

Explanation

• SSL/TLS Configuration: Sets strong encryption, disables outdated protocols, and enforces secure ciphers.
• HTTP Headers: Enforce HTTPS, prevent content sniffing, clickjacking, and cross-site scripting (XSS).
• SPF, DKIM, and DMARC (in DNS): Provide email security by authorizing legitimate mail servers, signing emails, and enforcing policy for unauthorized emails.

Applying Changes

After updating the Apache configuration, restart Apache:

sudo systemctl restart apache2

Make sure DNS records are correctly applied with your DNS provider to complete email security configuration. This setup enhances security for web and email by enforcing encrypted connections, authenticated email sources, and strict security policies.

To implement SPF, DKIM, and DMARC directly in Apache or NGINX, you cannot add them directly in the server configurations because they are DNS records, not HTTP headers.

Instead, these records must be added in the DNS zone file of your domain, usually through your DNS provider’s management interface.

However, you can implement email-related security headers such as DKIM and SPF in the HTTP headers for email servers or use email security tools on your server, but actual SPF/DKIM/DMARC records must reside in your DNS.

For Apache and NGINX, you manage HTTP security protocols directly in the server configuration, but for email security, update the DNS settings.

For email security protocols like SPF, DKIM, and DMARC, they cannot be configured directly in Apache or NGINX as these are DNS-level configurations. However, you can add HTTP headers related to security in both Apache and NGINX to protect against threats like XSS, clickjacking, and SSL vulnerabilities.

For email-related security, SPF, DKIM, and DMARC must be configured via your DNS provider, not within the Apache or NGINX configuration files.

Here’s how you can add HTTP security headers for email-related security (such as SPF, DKIM, and DMARC) in Apache and NGINX. Although SPF, DKIM, and DMARC configurations must still be added via DNS, you can configure headers in Apache and NGINX for email-related protection.

Apache Configuration Example

<VirtualHost *:443>
    ServerName example.com

    # SSL/TLS Configuration
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key

    # Enforce Email Security Headers (though DNS records must be set for actual email security)
    Header always set X-Mailer "SPF/DKIM/DMARC Secured"
    
    # HSTS Configuration (HTTP Strict Transport Security)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Content Security Policies (CSP)
    Header always set Content-Security-Policy "default-src 'self';"

    DocumentRoot "/var/www/example.com"
    <Directory "/var/www/example.com">
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

NGINX Configuration Example

server {
    listen 443 ssl;
    server_name example.com;

    # SSL/TLS Configuration
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;

    # Enforce Email Security Headers (though DNS records must be set for actual email security)
    add_header X-Mailer "SPF/DKIM/DMARC Secured" always;

    # HSTS Configuration (HTTP Strict Transport Security)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Content Security Policies (CSP)
    add_header Content-Security-Policy "default-src 'self';" always;

    root /var/www/example.com;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

Explanation

• X-Mailer: Added as an informational header to indicate email security (SPF, DKIM, DMARC).
• HSTS: Enforces HTTPS connections to prevent attackers from downgrading connections.
• CSP: Restricts content sources to reduce XSS attacks.
• SSL/TLS Configuration: Sets secure SSL/TLS protocols and ciphers for web traffic security.

Final Notes

While these headers provide additional security for HTTP traffic, SPF, DKIM, and DMARC configurations must still be handled in your domain’s DNS records. Apache and NGINX configurations do not replace DNS-level email security.