Free DNS Security Health Check

01 · Definition

What is dns security health check?

A DNS security health check audits a domain against a set of security controls — DNSSEC, DANE, CAA records, registry lock, and others — and returns a weighted A–F grade. The score reflects how well the domain is protected against DNS hijacking, cache poisoning, certificate mis-issuance, and related attack vectors.

The tool above runs a quick or full assessment across up to 13 categories and surfaces the gaps that carry the most risk. Each category returns a subscore with specific recommendations. Read the in-depth DNS security health check guide for what each category tests, how the grading is weighted, and the fastest path to improving your score.

02 · Process

How it works

1. 1Enter the domain.Enter the domain you want to assess. The tool resolves DNS records for the domain and its subdomains as needed.
2. 2Choose scan depth.Quick checks the most critical controls (DNSSEC, CAA, authentication). Full assesses all 13 categories including infrastructure, monitoring, privacy, and third-party risk.
3. 3Score each category.Each category earns points based on which controls are present and correctly configured. Subscores are weighted to reflect real-world risk severity.
4. 4Return the grade.The weighted average across all categories produces a final score (0–100) and an A–F grade. Grades: A = 85–100, B = 70–84, C = 55–69, D = 40–54, F = 0–39.
5. 5Surface recommendations.The tool lists the specific changes needed to address the highest-scoring gaps first, so you know where to focus remediation effort.

03 · Risk

Why it matters

DNS is the entry point to your domain. An attacker who controls your DNS can redirect your email, intercept web traffic, and obtain fraudulent certificates — all without touching your servers. Controls like DNSSEC prevent record tampering, CAA prevents unauthorised certificate issuance, and registry lock prevents registrar-level hijacking.

For financial services firms, DNS security is an operational resilience requirement under FCA PS21/3, PRA requirements, and DORA. An auditor asking for evidence of domain security posture expects to see DNSSEC configured, CAA records restricting certificate issuance, and registry lock on critical domains. The tool surfaces the gaps and provides the evidence trail needed to address them.

04 · Use cases

Common ways to use this tool

• Pre-compliance audit. Run the check before a regulatory review to surface DNS security gaps that an auditor would flag — DNSSEC absence, missing CAA records, or no registry lock.
• New domain configuration. After registering a domain and configuring DNS, use the health check to confirm DNSSEC is enabled and all required security controls are in place before going live.
• Third-party domain risk assessment. Assess DNS security posture of partner or vendor domains before integrating them into your mail or payment flows.
• Baseline and benchmark. Record the score before and after a DNS security hardening project to demonstrate measurable improvement to stakeholders.

05 · Interpretation

What to check in the result

• Grade F or D. A failing grade means critical controls like DNSSEC are absent. Start with the first recommendation — typically enabling DNSSEC and publishing CAA records — as these carry the highest weight in the score.
• DNSSEC score: 0. DNSSEC is not enabled. This is the most common reason for a low grade. Enable it at your DNS registrar or DNS provider and verify with an SPF lookup to confirm propagation.
• CAA score below maximum. Your CAA record exists but is missing the issuewild or iodef tags, or does not restrict to specific certificate authorities. Add the missing tags to improve this subscore.
• Registry lock: 0. Your domain does not have registry lock enabled. Contact your registrar to request this feature — it prevents unauthorised transfers or NS record changes at the registry level.
• Authentication and infrastructure: low. Low scores on these categories often indicate missing SPF, DKIM, or DMARC records, or nameservers not meeting redundancy requirements. Use the SPF lookup and DMARC lookup tools to address these in sequence.