Blog · DNS security
DNS and domain security
DNS is the part of your infrastructure everyone depends on and almost nobody reads. It is also completely observable from outside, which makes it the cheapest place to find real problems.
Every customer who types your domain name is trusting an answer they did not verify. DNS is the system that answers them: where the website lives, where mail goes, which certificate authority may issue for the name, and increasingly whether the answer itself was signed.
Because those answers are public by design, an outsider can audit them without touching anything private. That is the unusual advantage of DNS security work: nearly all of it is inspection, and almost none of it requires access.
Every post in this cluster ends with the same question: what would you do on Monday? Where a check can be run by hand, the command is in the post. Where it cannot, the post says so rather than implying a tool will handle it.
Reference article
For the specification-level detail behind these guides — mechanisms, edge cases and what the standard does not cover:
DNSSEC in plain terms: what it protects and what it does notWhat the tool checks
The controls this cluster maps to.
Pulled from the published 22-control catalog, with the weights that drive the posture score.
| Control | What is evaluated |
|---|---|
| DNSSEC chain validation | Whether the zone is signed and the delegation from the parent zone validates end to end. |
| CAA authorisation | Whether the domain restricts which certificate authorities may issue for it. |
| Zone transfer exposure | Whether an unauthorised AXFR request is refused. |
| Name record hygiene | Stale, dangling or surplus records that point at infrastructure you no longer control. |
| Address resolution | Whether the apex and www records resolve coherently over IPv4 and IPv6. |
Other clusters
Keep going elsewhere
Check this area on your own domain.
The assessment covers all five clusters, with the observation quoted behind every conclusive finding.