HardenedHost
An open engineering notebook by Najib Asmaty on IT infrastructure, cybersecurity, GRC, and automation. Longer articles break down architectures and production runbooks; shorter notes capture day-to-day troubleshooting, PowerShell snippets, and lessons from the field.
Recent notes
All notes →Articles
- Exchange Online Mailbox Full Runbook: Split Quotas, Retention Holds, and MRM vs. Purview Architecture
A production engineering runbook for diagnosing and resolving Exchange Online mailbox storage exhaustion. Understand ProhibitSend vs. ProhibitSendReceive quotas, why RetentionHoldEnabled freezes Online Archiving, how legacy Exchange MRM coexists with Microsoft Purview, and how to safely restore mail flow without saturating Recoverable Items.
- Passkeys & FIDO2 WebAuthn Architecture: The Enterprise Guide to Phishing-Resistant Authentication
A deep-dive technical field guide to FIDO2, W3C WebAuthn, and passkeys. Compare Device-Bound vs. Synced credentials, leverage AAGUID attestation whitelisting, close the Conditional Access password fallback trap, and execute a 6-phase zero-password MSP rollout.
- Email Authentication & Security Protocols: A Field Guide to STARTTLS, SPF, DKIM, DMARC & ARC
A comprehensive, engineering-grade guide to modern email security protocols. Understand how STARTTLS, SPF, DKIM, DMARC, and ARC work in concert to eliminate spoofing, stop tampering, and satisfy CISA BOD 18-01.
- Mastering Email Infrastructure: A Step-by-Step Guide to DNS Email Records & Cloudflare Configuration
A production runbook for configuring and migrating email DNS records. Learn how to extract MX, SPF, and DKIM records from cPanel, publish to Cloudflare DNS with unproxied Gray Cloud status, and verify resolution using PowerShell and dig.
- Zero-Cost Enterprise Email Architecture: Cloudflare Routing + Amazon SES
How to architect a resilient, production-ready custom domain email infrastructure with zero mailbox fees, complete SPF/DKIM cryptographic authentication, and unified inbox management.