tau.ac.il

1. Step 1 (monitoring, no effect on mail): publish p=none with an rua address to receive reports.
2. Step 2: analyze reports for 2–4 weeks and make sure every legitimate sender passes SPF/DKIM.
3. Step 3: move to p=quarantine, and finally to p=reject.

_dmarc.tau.ac.il.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@tau.ac.il; fo=1"

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. Jumping straight to reject without a monitoring phase can block legitimate mail.

1. Set up a permanent (301) redirect from every HTTP request to HTTPS on the server or CDN.
2. Then add an HSTS header.

server {
  listen 80;
  server_name tau.ac.il www.tau.ac.il;
  return 301 https://$host$request_uri;
}

Safety: This change is made on your server. Make sure HTTPS works first, otherwise the site won't load.

1. Start with a short max-age (300 seconds) and make sure every subdomain works over HTTPS.
2. Gradually raise it to 31536000 (one year) and add includeSubDomains.
3. Consider preload only once the policy is stable — removal from the preload list is slow.

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Safety: This change is made in your server/CDN settings. Test on staging before production. HSTS is cached in the visitor's browser — a long max-age on a site without working HTTPS will block access.

1. First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
2. Collect violations for a week or two and tune the policy to your legitimate sources.
3. Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.

1. Set Referrer-Policy: strict-origin-when-cross-origin.

/*
  Referrer-Policy: strict-origin-when-cross-origin

Safety: This change is made in your server/CDN settings. Test on staging before production.

1. Enable DNSSEC at your DNS provider (one click at most providers).
2. Copy the DS record your provider generates to your domain registrar.
3. Wait for propagation and verify with DNSViz.

dig +dnssec tau.ac.il SOA
delv tau.ac.il

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. A wrong DS record at the registrar will make the domain stop resolving — copy it exactly from the provider.

1. Identify which certificate authority issued your current certificate (see the certificate check).
2. Publish CAA for that authority only, and add iodef to receive alerts.

tau.ac.il.  CAA  0 issue "letsencrypt.org"
tau.ac.il.  CAA  0 iodef "mailto:security@tau.ac.il"

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. If your CDN issues certificates on your behalf, include it too — otherwise certificate renewal will fail.