Email & DNS Security Baseline

A comprehensive set of foundational security controls required across the organization-wide (platform-agnostic) email and DNS surface: email authentication (SPF, DKIM, DMARC, BIMI), transport encryption (MTA-STS, TLS-RPT, DANE), DNS security (DNSSEC, registrar lock, protective/filtered DNS), and email threat protection (gateway, sandbox, external forwarding block). Framework: SANS CIS Controls v8 Control 9; these controls close the domain spoofing, BEC, and encrypted C2 attack surface.