// tool reference · Network & Firewall
Domain DNS Audit Free
Audit a domain's DNS: SPF, DKIM, DMARC, CAA and delegation hygiene.
What it does
Audits the DNS records that decide whether someone can spoof your email or mis-issue a certificate for your domain.
When to use it
- Hardening email deliverability and anti-spoofing; pre-audit checks.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| domain | text | required | Domain to audit. |
What you get back
Per-record findings with the exact record to publish.
Worked example
Input
example.com
Output (abridged)
SPF PASS v=spf1 include:_spf.google.com ~all
'~all' is softfail. Once confident, move to '-all' --
softfail lets spoofed mail through as 'suspicious'.
DKIM PASS selector 'google' present
DMARC WEAK v=DMARC1; p=none;
<- THE FINDING. p=none monitors and enforces nothing.
Anyone can spoof your domain today and DMARC will
dutifully report it while delivering it.
-> p=quarantine, then p=reject once reports are clean.
CAA MISSING
-> any CA may issue for your domain.
-> example.com. IN CAA 0 issue "letsencrypt.org"
MX OK 2 records, both resolving.
How it works
Deterministic DNS resolution and policy parsing.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
It reads published DNS. It cannot tell you whether your mail actually authenticates in practice -- a correct SPF record with a misconfigured relay still fails.
Privacy
Nothing is stored.
Standards
SPF (RFC 7208)DMARC (RFC 7489)CAA (RFC 8659)