What DNS security means for a small business

When a customer types your domain into a browser, something has to answer the question "where does this live?" and "where does mail for this go?" That something is DNS, a distributed directory that has been answering those questions since the 1980s and has accumulated an impressive collection of failure modes along the way.

For a small business, DNS security is not exotic. It is a short list of concrete mistakes: a record pointing at a service you closed, a policy record nobody updated, a registrar account with a reused password, a domain auto-renewing off a card that expired.

Why it is worth looking at from outside

Almost everything an outsider can learn about your infrastructure begins with a DNS query. Address records tell them where you are hosted. MX records tell them who handles your mail. TXT records announce whether your email is authenticated. CAA records say which certificate authorities are allowed to issue for your name. None of that requires access, because all of it is published on purpose.

This is the unusual advantage of the subject: a review does not need permission to read your own public records, and it does not disturb anything. If you own the domain, you are auditing yourself.

The five failures that keep turning up

1. A record still pointing at a retired service

Someone stood up a staging site at staging.yourdomain.com pointing at a Heroku app, an S3 bucket or a Shopify store. The project ended, the subscription lapsed, the record stayed. Whoever claims that service next inherits your subdomain — and with it, your domain's reputation and any cookies scoped to it. This is subdomain takeover, and it is entirely a hygiene problem rather than an attack.

# look for CNAMEs pointing outside your own zone
dig +short CNAME staging.yourdomain.com
dig +short CNAME blog.yourdomain.com

If the answer points at a hostname you no longer control, load it in a browser. A generic 404, a "no such app" page or a provider's default landing page means the target is unclaimed, which is the dangerous case. Delete the record if the service is gone.

2. No DNSSEC, so answers can be altered in transit

DNSSEC adds signatures to DNS answers so a validating resolver can tell a real answer from an injected one. It does not encrypt queries — anyone on the path still sees which name you looked up — but it does make silent substitution detectable.

# a DS record at the parent zone means the child zone is signed
dig +short DS yourdomain.com

# ask for signatures directly
dig +dnssec yourdomain.com A

The trade-off is real: signing requires registrar support for DS records and a DNS host that signs zones, and a botched key rollover takes the name offline for validating resolvers. Broken DNSSEC is worse than absent DNSSEC. If you enable it, add an expiry check to whatever calendar you actually look at.

3. No CAA record, so any authority may issue for your domain

CAA lets you name the certificate authorities allowed to issue for your domain. Without it, a mis-issuance anywhere in the world is valid for your name. It is a five-minute record and one of the least controversial hardening steps available.

dig +short CAA yourdomain.com
# 0 issue "letsencrypt.org"
# 0 issuewild ";"            ; explicitly forbid wildcard issuance

Add iodef if you want a mailbox that receives reports when someone requests a certificate you did not authorise. Check your hosting and CDN providers first: some CAs need to be listed or renewals start failing at the worst possible moment.

4. Mail routing that nobody has read since setup

MX mistakes are quiet. A null MX (MX 0 .) is the correct way to say "this domain never receives mail" and is a sensible default for a domain used only for a website. A domain that sends but cannot receive is a different story, and an MX pointing at a hostname that no longer resolves is a third. All three are visible in one query.

dig +short MX yourdomain.com
dig +short TXT yourdomain.com     # SPF lives here too

5. A registrar account that is the single point of failure

Every record above can be replaced in a minute by someone with access to your registrar account. That makes the account more important than any individual record: strong unique password, two-factor authentication that is not SMS if you can avoid it, registrar lock enabled, and a recovery address that reaches a person rather than a shared inbox someone left the company from. Add a calendar reminder for domain expiry that does not depend on the auto-renew card working.

A quarterly DNS routine that takes twenty minutes

Keep the output. Last quarter's answers are the only reliable way to notice a record that changed without anyone deciding to change it.

What an external check can see

SMB Scanner Lite evaluates five DNS controls from outside: address and record presence, the DNSSEC chain, CAA authorisation, zone-transfer exposure and name-record hygiene. Each finding quotes the answer it received, so you can re-run the query and compare — including when the answer differs, which usually means a different resolver or a change made since the assessment. For the mechanics of signing and validation, the reference article on DNSSEC in plain terms goes deeper.

What this cannot see: records inside a private zone, anything behind split-horizon DNS, and your registrar account itself. Those need a human with access, which is exactly why the routine above is worth keeping.

What SMB Scanner Lite checks here

These are the controls from this area that the assessment evaluates from outside, without credentials and without touching anything private. Each one returns a status and, for every conclusive result, the record, header or handshake that produced it.

Only assess domains you own or are authorised to test — see responsible use. The published recorded assessment shows how a result and its evidence appear in a report, and the control catalog lists all 22 controls with their weights. Reference detail for this topic lives in DNSSEC in plain terms: what it protects and what it does not.