- Ensure DNS records pointing to hostnames have valid targets without takeover risk
- Ensure DNS records do not use wildcard entries
- Ensure DNS records do not expose internal IP addresses
- Ensure Cloudflare proxy is enabled for applicable DNS records
- Ensure WAF is enabled