DNS security audit

What gets checked

• DNSSEC: whether the domain is cryptographically signed, whether the signature chain is intact, which algorithms are used and how long the signatures remain valid. Broken signing can make a site unreachable, so this is checked carefully.
• Certificate-issuance rules: whether the domain states which authorities may issue certificates for it, so a rogue certificate is harder to obtain.
• Nameserver hardening: whether the nameservers answer questions they shouldn’t, reveal their software version, or allow a full download of the zone.
• Wildcard and private addresses: unintended catch-all records, and records pointing at private network addresses.

Subdomain takeover risk

Over the years most organisations accumulate subdomains that point at services they no longer use: an old shop, a retired campaign site, a trial of a hosting product. If the destination has been cancelled, someone else may be able to claim it and serve their own content under your name. The audit flags these dangling records so you can remove them, protecting both your visitors and your brand’s reputation in search.

Safe by design

The audit only asks questions that any internet user is allowed to ask. The zone transfer test, for instance, tries once and reports whether it was allowed or refused, along with a count of records; it never displays or stores the zone’s contents.

Combine the audit with SSL & website checks for a full picture of a domain’s defences, or run the Domain Health Check for everything at once.

Who should run it, and when

You don’t need to be a security specialist to benefit. The audit is written for the person who looks after the website, and each finding comes with a suggested next step.

• After a redesign or migration, when old records are most likely to be left pointing at services that no longer exist.
• When you take over a domain from another agency, an employee or a previous owner.
• For agencies that manage many client domains and want a repeatable way to check each one.
• Ahead of a security questionnaire, when a client or partner asks about your domain’s protections.

Because the audit is scored, it also works as a simple benchmark. Run it, make the recommended changes, run it again and see the number improve. Saved reports keep the earlier results so you can show what changed and when. Nothing about the audit needs access to your account at the registrar or host, which means it can be shared with clients or run as part of a pre-sales conversation.

Working through the findings

Every finding is labelled passed, warning or failed, and each failure explains the risk in a sentence or two before suggesting the change. Start with anything marked failed, because those are the items most likely to be exploited, then move to the warnings, which are usually improvements in resilience rather than urgent holes. Re-run the audit after each change to confirm it worked; because the checks are quick and read-only, there’s no cost to running it as often as you need.

Reports can be saved and reopened, which makes it easy to keep a record of the work you’ve done for a client.

Frequently asked questions