17 days
My server was recently compromised via the latest vulnerability. Fortunately, the damage wasn’t too severe. Since my server must remain publicly accessible, it can’t be hidden behind a VPN—I can only minimize its exposure as much as possible while ensuring my backup and recovery processes are rock-solid. I’ve configured the firewall to allow only essential ports, restricted SSH access to key-based authentication, enabled automatic installation of security updates, and set up daily backups, one of which is synchronized to an off-site location. Some have suggested treating public-facing machines as if they’ve already been compromised by default. I agree with this approach, and it’s exactly what I plan to do next.
I’ve taken the second approach you mentioned: I own the domain, host my email with a service provider (I use Zoho Mail), and manage my DNS through Cloudflare. Here are three insights I’ve gained from this experience.
First, by managing your email provider and domain DNS separately, if you ever want to switch providers in the future, you’ll only need to update the MX and a few TXT records. Your email address will remain the same, and others won’t even notice.
Second, set up SPF, DKIM, and DMARC right from the start. Be sure to enter the recipient address for DMARC aggregate reports so you can receive daily reports showing which servers are sending emails using your domain and whether they’ve passed verification.
Third, even if a new domain passes all three checks, emails sent to Outlook may still end up in the spam folder at first. This is because the new domain lacks a reputation. It’s not a configuration error, and it takes time to gradually build that reputation.