Website Security
DNS Security Scanner
Resolves your domain's DNS records and audits email authentication, nameserver posture, DNSSEC, and subdomain-takeover exposure across 21 checks.
What is DNS Security Scanner?
DNS is the address book of the internet — it maps your domain to servers, routes your email, and holds records that prove who's allowed to act on your behalf. DNS security is about the records that protect that layer: email-authentication records (SPF, DKIM, DMARC) that stop others spoofing your domain, DNSSEC that stops your lookups being forged, and hygiene checks that catch forgotten subdomains an attacker could hijack. It's the security layer most teams set once and never revisit.
What Nandix checks
- Email authentication — SPF (missing, multiple, +all, ~all, too permissive, ptr), DKIM, DMARC (missing, p=none, no rua/ruf)
- CAA records and nameserver diversity/redundancy
- DNSSEC, SOA serial format, and high SOA/record TTLs
- AAAA presence and wildcard DNS
- Dangling CNAME and subdomain-takeover exposure
Probes
21 checks
How it detects
Passive. Records are gathered using only the Node.js built-in resolver — address, mail, TXT/SPF/DMARC/DKIM, NS, CAA, CNAME, SOA, DNSSEC, and wildcard facts — then evaluated against the probe set. Dangling-CNAME and takeover checks assess whether a target still resolves to a claimable service; nothing is registered or claimed.
Why it's dangerous
Weak DNS security has two big consequences. First, email spoofing: without proper SPF and a DMARC policy set to reject, anyone can send email that looks like it came from your domain — the backbone of phishing and business-email-compromise scams that damage your brand and your customers. Second, subdomain takeover: when a subdomain still points (via a dangling CNAME) at a cloud service you no longer use, an attacker can claim that service and host content on your subdomain — serving malware or phishing from a domain your users trust.
Example finding
DMARC is set to p=none, so spoofed email claiming to be from your domain is delivered rather than rejected — enabling phishing.
How to fix it
Lock down authentication and clean up stale records. Publish SPF listing only the servers allowed to send your mail, and avoid an overly permissive +all. Set DMARC to p=reject (after monitoring with p=none first) so spoofed mail is rejected, and collect reports via rua. Enable DNSSEC so your DNS responses can't be forged in transit. Audit for dangling CNAMEs — remove DNS records pointing at decommissioned services before someone claims them. Add CAA records to control who can issue certs for your domain.
text
; SPF — only these may send mail
example.com. TXT "v=spf1 include:_spf.google.com -all"
; DMARC — reject spoofed mail, send reports
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Severities & standards
Severities
CRITICAL · HIGH · MEDIUM · LOW
References
Frequently asked questions
What's the difference between SPF, DKIM, and DMARC?
SPF says which servers may send your mail; DKIM cryptographically signs messages; DMARC ties them together and tells receivers what to do with mail that fails — and sends you reports. You want all three.
What is a subdomain takeover?
When a subdomain's DNS record still points at a third-party service you've stopped using, an attacker can register that service and control content on your subdomain — abusing the trust in your domain.
Is DNSSEC worth enabling?
It meaningfully protects against DNS spoofing and cache-poisoning. It takes some care to set up and maintain, but for domains handling sensitive traffic it's a strong addition.
See how every check runs on the methodology page, or browse all scanners.
Scan your site for this →Free DNS security scanner. Nandix audits SPF, DKIM, DMARC email authentication, DNSSEC, CAA records, and dangling-CNAME subdomain-takeover exposure across 22 checks.