← all checklists

DNS, CDN, Edge & WAF

82 items · source

Copy as markdown

Filter items

DNS, CDN, Edge & WAF

• Verify nameserver configuration.
• Verify registrar account MFA.
• Verify registrar lock/transfer protection.
• Verify DNSSEC.
• Verify all DNS records.
• Identify stale DNS records.
• Identify unused subdomains.
• Identify dangling CNAMEs.
• Identify dangling delegated subdomains.
• Identify third-party SaaS records.
• Identify DNS-only records exposing origins.
• Identify direct IP records.
• Verify IPv6 records.
• Verify mail records.
• Verify SPF.
• Verify DKIM.
• Verify DMARC.
• Verify BIMI where applicable.
• Verify TXT verification records.
• Review NS delegations.
• Review wildcard DNS.
• Review wildcard subdomains.
• Review CNAME flattening behavior where security/domain-verification implications exist.
• Identify the actual origin IP.
• Verify firewall rules reject unauthorized direct traffic.
• Verify origin TLS.
• Verify origin certificate validity.
• Verify origin certificate hostname coverage.
• Verify TLS versions/ciphers.
• Verify origin authentication.
• Evaluate Authenticated Origin Pulls/mTLS.
• Verify direct-origin requests fail.
• Verify attacker cannot bypass WAF by discovering the origin IP.
• Verify monitoring endpoints do not expose the origin.
• Verify cloud provider default endpoints do not bypass the edge.
• Verify staging origins are not publicly exposed unintentionally.
• Verify the edge provider's DDoS protection is enabled for the zone, and that the origin's own network exposure is small enough that the protection cannot be walked around — see *Origin protection* above.
• Verify the "under attack" or managed-challenge mode has been switched on once in staging: who is allowed to flip it, how long it takes, and which API clients, webhooks and mobile apps break when they are challenged.
• Verify HTTP/2 is terminated at the edge or by a server patched for rapid reset (CVE-2023-44487), and that HTTP/2 stream and connection limits are set on whatever terminates it.
• Verify the layer-7 rate limit counts what the attack costs — requests to the expensive route, not requests to the zone — and that a limit exists per authenticated identity as well as per IP.
• Enable appropriate WAF protections.
• Review custom WAF rules.
• Review exclusions.
• Review bypass rules.
• Verify sensitive API endpoints have rate limiting.
• Rate-limit login.
• Rate-limit password reset.
• Rate-limit signup.
• Rate-limit OTP.
• Rate-limit expensive APIs.
• Rate-limit file uploads.
• Rate-limit admin endpoints.
• Verify bots cannot easily bypass with distributed IPs.
• Verify rate limits account for authenticated identity where possible.
• Verify WAF false-positive exclusions do not create broad bypasses.
• Verify WAF rules cover APIs separately from browser pages.
• Verify managed rules are updated.
• Review security events regularly.
• Replace broad global API keys where possible with scoped API tokens.
• Verify minimum permissions.
• Verify token expiration/rotation.
• Verify CI tokens are distinct from human tokens.
• Verify tokens are not stored in repositories.
• Verify tokens are not shipped to frontend/mobile clients.
• Verify token use is audited.
• Verify leaked tokens can be rapidly revoked.
• Verify cache rules.
• Verify authenticated responses cannot enter shared cache.
• Verify sensitive API responses are not cached.
• Verify cache keys.
• Verify query-string normalization.
• Verify cache poisoning resistance.
• Verify request-header normalization.
• Verify host-header handling.
• Verify origin header trust.
• Verify WebSocket security.
• Verify API token/header stripping.
• Verify Workers cannot be altered by unauthorized users.
• Review every Worker.
• Review every KV/config secret.
• Verify Workers cannot access unrelated resources.
• Verify redirects cannot create open redirect vulnerabilities.