CART Web Security Worksheet

Domain registrar account uses MFA

DNS hosted with a reputable provider (Cloudflare, Route53, etc.)

Only current, expected A/AAAA/CNAME records exist (no legacy IPs)

whois contact info is accurate and protected (privacy or alias)

SPF record is present and correct (only authorized senders)

DKIM is enabled and validated for all sending services

DMARC is configured with at least p=quarantine (ideally p=reject)

Someone regularly reviews DMARC reports (or a service does)

All site pages enforce HTTPS (no mixed content)

Only TLS 1.2+ allowed; older protocols disabled

Certs auto-renewed (e.g., Let's Encrypt, managed CA)

HSTS enabled (if compatible with all use cases)