Twenty-two controls, documented one by one.

Whether the apex name publishes resolvable A and AAAA records, whether the answers are consistent across resolvers, and whether the name is reachable at all.

Everything else in an external assessment depends on this. A name that does not resolve is either a misconfiguration or an outage - both are visible to customers before they are visible internally.

Whether the zone is signed, whether a DS record exists at the parent, and whether the chain validates when queried through a validating resolver.

Without DNSSEC, a forged DNS answer is indistinguishable from a real one for most clients. It does not encrypt traffic; it makes tampering detectable.

Whether the domain publishes CAA records, which certificate authorities they name, and whether the policy includes a reporting address.

CAA restricts which CAs may issue for your name. It reduces - but does not eliminate - the chance of an unauthorised certificate being issued by a compliant CA.

Whether each authoritative nameserver answers an AXFR or IXFR request from an unauthorised client.

A zone that transfers to anyone publishes the complete map of internal hostnames and services. Modern DNS servers refuse this by default; older or misconfigured ones do not.

Dangling CNAMEs, records pointing at decommissioned hosting, orphaned service records and unexpected wildcard answers.

A record that points at a name nobody controls any more is the classic subdomain-takeover path. It is quiet, cheap to fix and easy to miss from inside.

Whether an SPF record exists at the apex, which mechanisms it authorises, and whether the policy ends in a hard fail (-all), a soft fail (~all), or no enforcement at all.

SPF tells receiving servers which hosts may send your mail. A soft policy tells them to be suspicious; a hard fail tells them to reject.

Multiple SPF records, recursive lookup count against the RFC 7208 limit of 10 DNS-querying mechanisms, void lookups, and syntax errors that cause permerror.

An SPF record that errors out is worse than a simple strict one: receivers fall back to a permerror result and policy enforcement becomes unpredictable.

The published _dmarc policy (none, quarantine or reject), the subdomain policy, alignment modes (adkim/aspf), and the reporting addresses.

DMARC is the policy layer: it tells receivers what to do when SPF or DKIM fails. p=none asks for reports; p=reject actually stops spoofed mail.

Whether discoverable selectors publish keys, the key type and length, and whether weak or revoked keys are still in use.

DKIM signs the message itself, so a forged message cannot carry a valid signature. Short or misconfigured keys weaken that guarantee.

Whether MX records exist, where they point, whether a null MX (RFC 7505) is published for domains that do not accept mail, and whether the routing is internally consistent.

A domain that does not send mail should say so. A missing or contradictory MX is an invitation for forged mail to be delivered to a fallback host.

Which protocol versions the endpoint negotiates, and whether deprecated versions (TLS 1.0/1.1, SSLv3) are still accepted.

Old protocol versions carry known weaknesses and are deprecated by every major standards body. A modern baseline is TLS 1.2 with TLS 1.3 preferred.

Trust chain, expiry, hostname or SAN coverage, and whether the presented certificate is the one a browser will accept without a warning.

An expired or mismatched certificate trains users to click through warnings - which is exactly the habit phishing relies on.

Whether modern AEAD suites are offered, whether ephemeral key exchange (ECDHE) is available, and whether legacy CBC or export-grade suites remain enabled.

Forward secrecy means a stolen private key cannot decrypt traffic recorded earlier. Legacy suites are the first thing removed in a hardening pass.

Whether plain HTTP on port 80 redirects to HTTPS, whether the redirect is permanent, and whether any resource is still served unencrypted.

A site that answers HTTP without redirecting gives an attacker on the path a free opportunity to intercept or rewrite the first request.

Whether HSTS is sent over HTTPS, the max-age it declares, whether it covers subdomains, and whether it is submitted for preloading.

HSTS tells the browser to refuse plain HTTP for this host in future. It is the only control that protects the very first request of a later visit.

Whether a CSP is present, whether it restricts script sources, and whether it uses unsafe-inline, unsafe-eval or a wildcard that would defeat the purpose.

CSP is the main browser-side mitigation against cross-site scripting. It does not fix an injection bug, but it limits what the injected script can do.

X-Frame-Options or CSP frame-ancestors, and X-Content-Type-Options: nosniff.

Framing protection stops a page being embedded invisibly behind a click target. nosniff stops a browser guessing a content type and executing something it should not.

Referrer-Policy, Permissions-Policy, and whether Server or X-Powered-By headers advertise exact software versions.

Version banners save an attacker reconnaissance. Referrer and permissions policies limit what a page leaks or is allowed to use on the visitor's device.

Whether a defined set of high-risk services (FTP 21, Telnet 23, SMTP 25, direct database ports 3306/5432/6379/27017) accepts a TCP connection from the public internet.

These services were never designed to face the internet. Reachability alone is a finding; the assessment never attempts authentication.

Whether port 445 completes a single unauthenticated SMB2 negotiate, and which dialect and signing requirements are advertised in the response.

SMB exposed to the internet is the ingress path behind several ransomware campaigns. The check reads the negotiate response only: no session, no shares, no credentials.

Whether TCP 3389 accepts a connection and completes a protocol handshake, and whether the negotiated security layer is current.

Internet-facing RDP is routinely brute-forced. Even with strong passwords, exposure widens the attack surface to anyone with a scanner.

Whether common management interfaces (phpMyAdmin, admin panels, Elasticsearch, Docker API) answer on standard ports without a network-level restriction.

An admin panel reachable from the internet is one credential away from full control. Network restriction is usually the cheapest available fix.