DNS Security Checker

Review a public domain's DNS records and get an AppSec Santa heuristic score from A+ to F, covering DNSSEC, SPF, DMARC, CAA, NS, SOA, MX, and one CNAME check.

Part of AppSec Santa's free website security scanners — five browser tools, no signup.

8 Public DNS Checks in Seconds

Enter a public domain name to inspect selected DNS records and the narrow conditions described in the methodology.

Instant A+ to F grade
DNSSEC validation check
SPF and DMARC record and policy checks
Queried-name CNAME target check

🔒

DNSSEC

Resolver answer authentication

✉

SPF + DMARC

Email authentication policies

📋

CAA Records

Queried-name CAA tags

⚠

Queried-name CNAME

Queried-name CNAME resolution check

Review Published Email Policies

The checker inspects SPF record count and the all qualifier, plus DMARC record count and p/pct tags. It does not discover DKIM selectors, execute message alignment, or predict receiver delivery decisions.

SPF record discovery and all qualifier
DMARC p and pct policy tags
MX and null MX interpretation
Scope and remediation caveats

Example Results

SPF Record +15

DMARC Record +15

DNSSEC -15

CAA Records 0

Queried DNS Record Types

See answers returned for the eight queried types: A, AAAA, MX, NS, TXT, CAA, SOA, and CNAME. The output is a resolver snapshot, not a complete zone inventory.

Eight selected DNS record types
TTL values and returned record data
One-click copy for sharing
Queried through Cloudflare DNS over HTTPS

Raw DNS Records

; A Records
example.com  300  IN  A  93.184.216.34

; MX Records
example.com  3600  IN  MX  10 mail.example.com

; TXT Records
example.com  3600  IN  TXT  v=spf1 -all

DNS Scan: —

Score: 0 / 100

Scan Time: —

Tests Passed: 0 / 0

Test	Score	Reason	Recommendation

What Is DNS Security?

DNS maps names to records used by web, email, and other services. This checker reviews a limited public-record snapshot against protocol rules from the relevant IETF RFCs and guidance in the final NIST SP 800-81r3. It is not a complete DNS audit or certification.

DNSSEC

+15 / -15

DNSSEC lets validating resolvers authenticate signed DNS data. This check uses the resolver's authenticated-data response for the queried A answer. A false result means that answer was not authenticated; it does not diagnose the domain's full DNSSEC configuration.

Reference: RFC 4033, 4034, 4035 · NIST SP 800-81r3

SPF

SPF Record

+15 / -15

SPF lets a domain authorize mail senders through a TXT policy. This check finds SPF records and interprets the all qualifier. Multiple SPF records cause a permanent error, while the receiving system decides what to do with fail or softfail results.

Reference: RFC 7208

DMARC Record

+15 / -15

DMARC evaluates identifier alignment through SPF or DKIM and publishes a requested receiver policy. This check reads the p and pct tags but does not test DKIM, message alignment, or delivery. Multiple DMARC policy records prevent normal policy discovery.

Reference: RFC 7489

CAA

CAA Records

+5 / 0

CAA issue and issuewild tags can authorize certificate issuers. Certificate authorities also search parent labels when the exact name has no CAA record. This checker queries only the submitted name, so an empty result does not prove that no applicable CAA policy exists.

Reference: RFC 8659

NS Record Count

+5 / -5

The checker counts distinct NS hostnames and awards points for two or more. RFC 2182 discusses network and geographic diversity, but hostnames alone cannot prove provider, network, or location independence.

Reference: RFC 2182 · NIST SP 800-81r3

SOA

SOA Record

+5 / 0

The Start of Authority record carries zone metadata and timers. The checker reports returned values but treats no exact-name answer as neutral because the submitted name may not be a zone apex. Appropriate timers depend on the DNS operator's design.

Reference: RFC 1035, RFC 1912

MX Records

+5 / -5

MX records identify mail exchangers. Without an MX record, SMTP can fall back to A or AAAA records; a null MX explicitly says that a domain accepts no mail. Multiple MX records do not by themselves prove independent or available mail infrastructure.

Reference: RFC 5321, RFC 7505 (Null MX)

Queried-name CNAME

0 / -10

The checker resolves the submitted name's CNAME target. An NXDOMAIN target is a dangling-record signal, but takeover also requires the target service to let another account claim the resource. Other subdomains and provider ownership are outside this check.

Reference: RFC 1034 §3.6

Scoring Methodology

The score starts at 100. Negative modifiers always lower it; positive modifiers count only when the negative subtotal remains at 90 or above. The result is capped at 100 before mapping to an A+ to F grade.

These weights are an AppSec Santa heuristic, not values defined by NIST or the RFCs. Use the individual findings for triage, not the grade as a certification or complete security assessment.

Test	Positive	Negative	Weight
DNSSEC	+15	-15	High
SPF Record	+5 to +15	-5 to -15	High
DMARC Record	+5 to +15	-5 to -15	High
CAA at Queried Name	+5	0	Low
MX Records	+5	-5	Low
NS Record Count	+5	-5	Low
SOA Record	+5	0	Low
Queried-name CNAME	0	-10	Medium

Standards & References

The references below define the protocols or provide deployment guidance. They do not define this checker's score weights.

NIST SP 800-81r3 — Secure DNS Deployment Guide (March 2026)

DNSSEC RFC 4033, 4034, 4035 — DNS Security Extensions

SPF RFC 7208 — Sender Policy Framework

DMARC RFC 7489 — DMARC

CAA RFC 8659 — CA Authorization Records

MX RFC 5321, RFC 7505 — SMTP & Null MX

SOA RFC 1035, RFC 1912 — DNS Operations

NS RFC 2182 — Secondary DNS Servers

Check Your HTTP Security Headers Too

DNS records and HTTP response headers expose different configuration signals. Run the headers checker for an additional view of the submitted site's browser-facing controls.

Check Security Headers