Analyze a domain
Deep DNS analysis — email security, attack surface, operational hygiene, automated risk scoring and prioritised recommendations.
Full DNS Audit checks multiple record types and best-effort subdomain discovery. It still cannot guarantee every subdomain on the Internet.
Try:
What this scanner can and cannot do
Every check is declared as data before it is implemented, so this page cannot drift from the scanner. Read it before you trust a green badge.
36 of 50 checks run live in your browser. 9 are inferences. 5 need raw socket access and run in the CI pipeline.
Checks in this buildCatalog
50
Run live in the browserLive scan
36
Inferences or history-onlyPartial
9
Need the CI pipelinePipeline only
5
Coverage by group
| Group | Checks | Live | Partial | Pipeline only |
|---|---|---|---|---|
| Takeover | 7 | 5 | 2 | 0 |
| DNS Integrity | 8 | 3 | 4 | 1 |
| DNS Server Security | 8 | 3 | 1 | 4 |
| Email Security | 10 | 10 | 0 | 0 |
| DNS Exposure | 17 | 15 | 2 | 0 |
Group links jump to the corresponding block of findings on the analyzer screen; when that block is not mounted the link simply stays on this page.
How to read the detectability labels
Live scanDetermined live in your browser over DNS-over-HTTPS.
PartialInferred rather than proven, or only reliable with saved scan history. Confidence is stated per finding.
Pipeline onlyRequires raw socket access, which a browser cannot perform. This check runs in the CI deep-scan pipeline.
Severity of catalog checks
Critical: 10High: 20Medium: 20Severity is the impact if a check fails. It says nothing about whether this browser could perform the check at all.“Pipeline only” means impossible here — not skipped
A web page cannot open a raw UDP or TCP socket, so it can never talk to a nameserver on port 53 directly. Everything this scanner learns about DNS arrives over DNS-over-HTTPS — plain HTTPS to a public resolver — or over ordinary HTTP requests. Checks that need a real socket, such as an AXFR attempt, open-recursion testing, per-nameserver probing or a version.bind query, are physically out of reach for any browser.
They are not skipped, and they are never reported as passing. They are handed to the CI deep-scan pipeline, which runs with a real network stack on a schedule and publishes JSON evidence as a build artifact. The 1 downloadable recipe below cover 5 of these 5 checks.
5 catalog checks are pipeline only: D06, D02, D04, D42, D43. Jump to the pipeline recipes.
The full check catalog
Every check this build ships, what it inspects, and how far it can be trusted. Nothing is left out of this list, including the checks that cannot be performed here.
Takeover
7 checks| ID | Check | Severity | Detectability | What is checked |
|---|---|---|---|---|
D01 | Subdomain takeover / dangling CNAME | Critical | Live scan | CNAME records whose target no longer resolves to an address, weighted towards targets on takeover-prone SaaS and cloud platforms. |
D08 | Wildcard takeover / dangerous wildcard | Critical | Live scan | A wildcard record that answers a random label and points at takeover-prone or unclaimed infrastructure. |
D09 | Dangling MX / mail-provider takeover | Critical | Live scan | MX targets that no longer resolve, or that resolve to NXDOMAIN. |
D38 | Unexpected wildcard record | Medium | Live scan | A wildcard answer for a random label that does not exist in the zone. |
D46 | Orphaned subdomain | Medium | Partial | Discovered subdomains that resolve but expose no reachable service and that you cannot account for. |
D47 | Orphaned cloud resource referenced by DNS | Medium | Partial | CNAME targets on cloud platforms (object storage, CDN, application hosting) that no longer resolve, or that answer with a provider 'not found' page. |
D48 | Unexpected external SaaS dependency | Medium | Live scan | CNAME targets on known third-party SaaS platforms, fingerprinted against the built-in provider list. |
DNS Integrity
8 checks| ID | Check | Severity | Detectability | What is checked |
|---|---|---|---|---|
D03 | Unauthorized NS delegation / DNS hijacking | Critical | Partial | NS records returned for the zone are compared against the saved scan for this domain and checked for names you do not expect: unresolvable nameservers, servers outside your known providers, and SOA serial changes since the last scan. |
D05 | DNSSEC validation failure | Critical | Partial | Presence of a DS record at the parent and DNSKEY records at the zone, read alongside the resolver's AD flag and any SERVFAIL over DoH; the RRSIG chain itself is not verified. |
D06 | Dangling NS / lame delegation | Critical | Pipeline onlyrecipe | Each nameserver delegated at the parent is queried directly for the apex and must answer with the AA flag; a name that is delegated but answers without authority, or does not answer at all, is lame. This requires targeting one chosen server, which DoH cannot do. |
D07 | Compromised/unauthorized nameserver | Critical | Partial | Authoritative answers are inspected for anomalies such as records absent from the parent delegation, SERVFAIL or REFUSED where an answer is expected, and SOA MNAME or serial changes since the last scan. |
D11 | DNSSEC not enabled | High | Live scan | No DS record (type 43) at the parent zone and no DNSKEY records (type 48) at the zone, with no RRSIG (type 46) returned for the apex even when the DO bit is set. |
D30 | NS delegation mismatch | High | Partial | The zone's own NS RRset is read over DoH and checked for internal consistency — every name resolves, and the SOA MNAME is one of them. The parent's delegated set cannot be read from the browser, because the resolver chooses which server answers. |
D31 | SOA primary server inconsistency | Medium | Live scan | The SOA MNAME is checked against the zone's own NS RRset, and the SOA serial is checked for sanity such as zero or a value that has gone backwards across scans. |
D49 | Unusual DNS delegation chain | Medium | Live scan | The NS RRset is queried at the zone apex and at each label in the name, which surfaces any deeper delegation that the parent record set does not explain. |
DNS Server Security
8 checks| ID | Check | Severity | Detectability | What is checked |
|---|---|---|---|---|
D02 | DNS zone transfer (AXFR) exposed | Critical | Pipeline onlyrecipe | A direct AXFR request to each authoritative nameserver over TCP port 53, checking whether the full zone is returned rather than refused. |
D04 | Open recursive resolver | Critical | Pipeline onlyrecipe | An RD=1 query with no recursion-desired flag stripped, sent to each authoritative server to see whether it recurses for an unrelated name. |
D28 | Nameserver single point of failure | High | Live scan | The NS RRset and the addresses behind it: a zone whose nameservers collapse to one address, one host, or one upstream network is a single point of failure. |
D29 | Nameserver geographic/provider concentration | High | Partial | NS hostnames and the ownership and rough location of the addresses they resolve to, used to infer whether the nameservers sit in one provider and one region. |
D42 | DNS server version disclosure | Medium | Pipeline onlyrecipe | CHAOS-class TXT queries for `version.bind`, `hostname.bind`, and `id.server` against each authoritative server. |
D43 | Public DNS server exposes unnecessary services | Medium | Pipeline onlyrecipe | A TCP port scan of each authoritative server, looking for services other than DNS reachable from the Internet. |
D44 | Missing secondary DNS | Medium | Live scan | Whether a genuine secondary exists: a second authoritative server, on its own address, that answers for the zone independently of the primary. |
D45 | DNS provider concentration | Medium | Live scan | The count of distinct DNS providers and distinct networks owning the addresses behind the NS RRset. |
Email Security
10 checks| ID | Check | Severity | Detectability | What is checked |
|---|---|---|---|---|
D12 | Missing DMARC | High | Live scan | A TXT lookup for `_dmarc.<domain>` returning no DMARC record. |
D13 | DMARC p=none | High | Live scan | The `p=` tag of the DMARC record: `p=none` requests that receivers take no action on failures. |
D14 | DMARC policy not enforced | High | Live scan | Enforcement gaps in the DMARC record: `pct` below 100, a relaxed `sp` on subdomains, or a `p=none` parent with no subdomain policy of its own. |
D15 | Missing SPF | High | Live scan | The absence of a TXT record beginning `v=spf1` at the domain, and at the envelope-from domain where the two differ. |
D16 | Multiple SPF records | High | Live scan | More than one TXT record starting with `v=spf1` at the same name. |
D17 | Unsafe SPF +all | High | Live scan | The `all` mechanism: `+all` or `?all` authorises every host on the Internet, and a missing `all` fails open to a neutral result. |
D18 | SPF DNS lookup limit exceeded | High | Live scan | The number of DNS-lookup mechanisms — `include`, `a`, `mx`, `ptr`, `exists`, `redirect` — in the SPF record, counted including the lookups each nested `include` performs. |
D19 | Missing DKIM | High | Live scan | DKIM public keys at the selector names used by the domain (`<selector>._domainkey.<domain>`) for each selector seen in the provider's documentation or the mail headers. |
D20 | Invalid DKIM record | High | Live scan | DKIM TXT records that fail to parse or contradict themselves: an empty `p=` tag, which revokes the key, a malformed `v=` or `k=`, or a `p=` value that is not valid base64. |
D21 | Weak DKIM key | High | Live scan | The key size of the public key in the `p=` tag of each selector's DKIM record. |
DNS Exposure
17 checks| ID | Check | Severity | Detectability | What is checked |
|---|---|---|---|---|
D10 | DNS rebinding exposure | Critical | Partial | A wildcard record, or a very low TTL on an attacker-controllable name, combined with an A/AAAA answer in private or loopback space (RFC 1918, 127/8, ::1). |
D22 | CAA missing | High | Live scan | Absence of any CAA RRset at the domain and its parent labels, walked up the tree as RFC 8659 specifies. |
D23 | Overly permissive CAA | High | Live scan | Parsed CAA tags where `issue` or `issuewild` names an unexpected or unknown CA, or a wildcard is permitted by an issuer not named in `issue`. |
D24 | Internal IP address exposed | High | Live scan | A/AAAA answers in RFC 1918 space (10/8, 172.16/12, 192.168/16), loopback (127/8, ::1), link-local (169.254/16, fe80::/10) or CGNAT (100.64/10). |
D25 | Internal hostname exposed | High | Live scan | CNAME, NS, MX, SRV and PTR targets, and PTR answers, whose labels match internal naming patterns (`.internal`, `.local`, `.corp`, `.lan`, `dc01`, `srv-`, `intranet`). |
D26 | Public staging/dev environment exposed | High | Live scan | A, AAAA, CNAME, NS and SRV labels matching dev, staging, test, qa, uat, preprod, demo or sandbox. |
D27 | Public admin/management hostname exposed | High | Live scan | A, AAAA and CNAME labels matching admin, manage, mgmt, portal, cpanel, phpmyadmin, jenkins, grafana, kibana, jump or bastion. |
D32 | Missing reverse DNS / PTR | Medium | Live scan | PTR lookups over DoH for each A/AAAA answer, via in-addr.arpa for IPv4 and ip6.arpa for IPv6; NXDOMAIN or an empty answer means no reverse DNS. |
D33 | Incorrect PTR ↔ A/AAAA mapping | Medium | Live scan | Forward-confirmed reverse DNS: each PTR name is resolved forward and compared against the address it was found from. |
D34 | Excessively long TTL | Medium | Live scan | TTL values above roughly 86400 seconds on A, AAAA, CNAME, MX, NS and TXT records. |
D35 | Extremely short TTL | Medium | Live scan | TTL values below about 300 seconds on A, AAAA, CNAME, MX and NS records, and an SOA minimum that forces very short negative caching. |
D36 | Stale/unused DNS records | Medium | Partial | Names that persist unchanged across previously saved scans of this domain; a browser cannot observe resolver traffic, so a saved scan is the only baseline available. |
D37 | Duplicate/conflicting records | Medium | Live scan | Duplicate identical records, a CNAME coexisting with other data at the same name, multiple CNAMEs on one name, and mixed public and private addresses in one answer set. |
D39 | Excessive DNS records / attack-surface exposure | Medium | Live scan | The count of distinct names and records reachable by enumeration, flagging zones above a configured threshold. |
D40 | Sensitive information in TXT records | Medium | Live scan | TXT strings matching credential and secret patterns (API key, secret, password, private key blocks), internal hostnames, cloud account or zone identifiers, and unexpected verification tokens. |
D41 | Deprecated/weak DNS configuration | Medium | Live scan | Deprecated or weak configuration: DNSSEC signing algorithms 5 and 7 (RSA/SHA-1), the SPF `ptr` mechanism, and obsolete record usage such as HINFO. |
D50 | Excessive TXT record exposure | Medium | Live scan | TXT record count per name and total string bytes, flagging sets above a configured threshold and long unique token strings. |
Pipeline recipes
Real workflow files, served statically from this site. Download one, commit it to your own repository, and the checks the browser cannot perform run on a real network stack with committed evidence.
DNS deep scan
dns8 checksScheduled GitHub Action that runs the checks a browser cannot: zone transfer, open recursion, per-nameserver lame delegation, parent-versus-zone delegation mismatch, nameserver change against a committed baseline, version disclosure and service exposure. Publishes JSON evidence as a build artifact.
ToolsdignmapjqGitHub Actions
Triggers
workflow_dispatchweekly schedulepush to dns-baseline.txtResolves these catalog checks
D02DNS zone transfer (AXFR) exposedD03Unauthorized NS delegation / DNS hijackingD04Open recursive resolverD06Dangling NS / lame delegationD07Compromised/unauthorized nameserverD30NS delegation mismatchD42DNS server version disclosureD43Public DNS server exposes unnecessary servicesDownload dns-deep-scan.yml
/pipelines/dns-deep-scan.ymlHow scoring works
The headline is a security score: 0-100 where 100 means every assessable check passed. Higher is better.
Security score
score = 100 × (assessable weight − penalty weight) ÷ assessable weightEvery failed check contributes its weight as a penalty, so a critical finding costs far more than a hygiene one. A passed check contributes nothing. Each check counts exactly once, however many per-record findings it produced.
Pipeline-only checks are excluded
Five checks need raw sockets and cannot run in a browser. They are left out of both sides of the ratio: counting them as passed would overstate the posture, and counting them as failed would invent a problem. They are handed to the deep-scan pipeline instead.
Not assessed is not failed
If a lookup fails, the affected check leaves the denominator too, so a resolver outage cannot silently deflate your score. The count is always shown next to the score, and the scan is labelled incomplete.
The grade is capped by severity
A pass ratio can look reassuring while something serious is broken, so the percentage never sets the grade on its own. A failed critical check caps the grade at POOR, and a failed high check caps it at WEAK. The number stays honest; the grade and its colour carry the severity.
Check weights
| Check | Weight | Conceptual basis |
|---|---|---|
| Dangling CNAME | 30 pts | Direct takeover opportunity if the service target is unclaimed. |
| Missing DMARC | 25 pts | No policy enforcement against spoofed email. |
| Missing SPF | 20 pts | Mail receivers cannot verify authorized senders. |
| Suspicious Provider CNAME | 18 pts | Known takeover-prone provider pattern requires ownership validation. |
| Weak DMARC (p=none) | 15 pts | Monitoring only, no reject/quarantine action. |
| Wildcard DNS | 12 pts | Undefined subdomains resolve, expanding attack surface. |
| Duplicate SPF | 10 pts | Multiple SPF records break evaluation; receivers return permerror. |
| Missing DKIM | 10 pts | Weakens email authentication alignment confidence. |
| Weak SPF (~all) | 8 pts | Soft fail lets spoofed mail through to spam filtering decisions. |
| Missing MX | 8 pts | Domain publishes no mail exchangers; delivery or null-MX hygiene unclear. |
| Missing NS | 8 pts | Delegation or authoritative resolution hygiene issue. |
| Duplicate MX | 5 pts | Repeated exchangers add resolution churn without redundancy value. |
| Missing CAA | 5 pts | No certificate issuance policy restriction. |
| TTL Too Low | 5 pts | Increases query churn and operational instability. |
| TTL Too High | 3 pts | Slows failover and remediation change propagation. |
Grade bands
Bands apply to the security score, where a higher number is better.
| Security score | Grade | Meaning |
|---|---|---|
| 90–100% | STRONG | Every assessable control passed, or close to it. |
| 75–89% | FAIR | Broadly healthy, with a few controls to tighten. |
| 50–74% | WEAK | Real weaknesses that are worth scheduling. |
| 25–49% | POOR | Material exposure requiring near-term action. |
| 0–24% | CRITICAL | Immediate remediation recommended. |
Why scoring matters
- Creates a common language between security, operations, and leadership.
- Helps prioritize remediation by impact instead of fixing low-value issues first.
- Allows trend tracking over time (risk burn down after fixes).
- Enables consistent triage when many domains/subdomains are in scope.
Data lifetime and privacy
There is no backend, no account and no telemetry.
- Your last scan is stored in this browser's
localStorageonly. They survive a page refresh and are permanently erased the moment you clear this site's browser data. - Clearing browser data is a complete wipe. Nothing is held anywhere else, so there is nothing to request, export or delete on a server — because there is no server.
- The only outbound requests are DNS-over-HTTPS lookups to Google and Cloudflare for the domain you scan. That means the domains you test are visible to those resolvers.
- Subdomain discovery uses a built-in dictionary of common labels. No certificate transparency lookup is performed.
OiO SecOps runs as a static site at secops.vibhuvioio.com. Because the bundle is static, anyone can download and read the client code.
Standards and reference sources
Each control maps to a published standard or public research fingerprint set.
| Control area | Reference | How it informs scanning and scoring |
|---|---|---|
| SPF | RFC 7208 | Defines SPF syntax/evaluation and hard vs soft fail behavior. |
| DMARC | RFC 7489 | Defines p=none/quarantine/reject and alignment-based policy enforcement. |
| DKIM | RFC 6376 | Defines the DKIM-Signature and key-record format probed at selectors. |
| CAA | RFC 8659 | Defines certificate authority authorization policy semantics. |
| DNSSEC | RFC 4033 / 4034 / 4035 | Defines authenticated DNS data chain-of-trust and validation behavior. |
| Core DNS (NS/TTL basics) | RFC 1034 / 1035 | Defines delegation, RR semantics, and foundational resolver behavior. |
| Negative Responses (NXDOMAIN) | RFC 2308 | Defines negative caching, used here to separate NXDOMAIN from failed lookups. |
| Cache Poisoning Resilience | RFC 5452 | Provides resolver hardening recommendations against forged answers. |
| Operational DNS Hygiene | RFC 1912 | Common DNS operational errors and practical configuration guidance. |
| Subdomain Takeover Research | can-i-take-over-xyz | Provider fingerprint intelligence for takeover-prone CNAME targets. |
DNS attacks and defensive controls
Public zone data reveals some of these, and cannot reveal others. The distinction is stated honestly.
| Attack | Defensive controls | Scoring relevance |
|---|---|---|
| NXDOMAIN Attack | Response rate limiting (RRL), anycast, caching strategy, capacity planning. | Operational risk signal; low TTL and weak hygiene can worsen impact. |
| DNS Cache Poisoning | DNSSEC validation, randomized source ports/IDs, hardened resolvers, patching. | Not inferable from public zone data; tracked as a roadmap control. |
| DNS Tunnelling | Query anomaly detection, egress filtering, RPZ, long-label entropy detection. | Requires resolver telemetry, which a public scan cannot see. |
| DNS Hijacking | Registrar lock, MFA on DNS accounts, change monitoring, strict IAM. | Governance control; not inferable from public DNS only. |
| DNS Pharming | DNSSEC, endpoint hardening, resolver trust controls, anti-malware. | Indirectly reduced by DNSSEC and secure resolver posture checks. |
| DNS Flood Attack | Anycast, autoscaling authoritative DNS, upstream DDoS protection. | Operational resilience dimension, often external to zone data. |
| DNS Amplification | Disable open recursion, response rate limiting, BCP38 anti-spoofing. | Infrastructure control; not directly visible from zone records. |
| DNS Brute Force / Enumeration | Monitor spikes in invalid queries, wildcard minimization, canary subdomains, WAF correlation. | Wildcard and dangling records increase exploitable enumeration value. |
ScannedChecks that public DNS can actually answer: SPF, DKIM, DMARC, MX, NS, CAA, TTL, wildcard, CNAME targets and dangling records.
Not scannedResolver-side signals such as query volume, DNSSEC validation failures and NS change monitoring. Those require telemetry this tool deliberately does not collect.
Source transparency: this tool applies standards-based checks and public research fingerprints. Numeric point weights are heuristic to support prioritisation and are not an official universal standard.