In this article
The grade and score
The big letter and the "score out of 100" summarise everything the audit found. The score starts at 100 and loses points for each problem, depending on how serious it is:
| Severity | Points lost if it's a Fix now | Points lost if it's an Improve |
|---|---|---|
| High | 15 | 8 |
| Medium | 8 | 4 |
| Low | 4 | 2 |
The letter follows from the score:
A90–100
B80–89
C70–79
D55–69
F0–54
It's a snapshot, not a pass markThe grade measures published DNS and public web settings against good practice. A C doesn't mean you've been hacked and an A doesn't mean you can't be. Use it to see direction: run the audit, fix the top items, run it again and watch the number rise.
The Score by area bars beside the grade work the same way for each category, but weigh problems three times as heavily, so a single serious issue stands out clearly. Click a bar to jump to that area's checks.
The four labels
| Label | Meaning | What to do |
|---|---|---|
| Fix now | A real weakness, or something that will break email or your website. | Work through these first, highest severity first. |
| Improve | Not broken, but below good practice. The risk is lower or needs more than one thing to go wrong. | Plan these in after the "Fix now" items. |
| Good | Checked and fine. | Nothing. Worth keeping, because it shows what's already working. |
| Info | Something worth knowing that isn't a pass or fail, such as how many subdomains were found or which mail provider you use. | Read it. Occasionally an info item will surprise you. |
Each Fix now and Improve item also carries a severity tag (high, medium or low) and, wherever possible, a Fix line plus a ready-to-paste record you can copy.
The four tabs
- Recommendations: only the problems, sorted with the most urgent first. Start here.
- All checks: every check in every area, including the passes, grouped and expandable. Use it to show a colleague, an insurer or your IT provider the whole picture.
- DNS map: a diagram of your name servers, mail servers, addresses and subdomains. It's good for spotting something unexpected, such as an address you don't recognise.
- Raw records: the actual DNS answers, exactly as received. This is the evidence behind every finding, useful when your IT provider asks "how do you know?"
The buttons at the top let you Share a link, Copy report as text, download JSON, or print PDF.
The eleven areas, one by one
| Area | What it checks | Why it matters |
|---|---|---|
| Registration | Domain expiry, registry holds, transfer lock, age | An expired domain takes your website and email offline, and someone else can register it. |
| Name servers | How many, whether they answer, whether they agree, whether they leak data (zone transfer, open recursion, version disclosure) | These servers answer for your whole domain, so they must be reliable and locked down. |
| SOA & zone | The zone's timing values | Poor values slow down changes or let outages last longer than they should. |
| DNSSEC | Whether answers are digitally signed, and with a modern algorithm | Stops forged DNS answers from sending visitors to a fake site. |
| Web & certificates | Website address, HTTPS certificate and expiry, outdated TLS, HSTS, security headers, CAA, security.txt | Protects visitors and stops browser warnings. |
| Mail servers | MX records, whether each mail server exists, null MX | Makes sure email can reach you, and only your servers. |
| SPF | The list of servers allowed to send as you, and the 10-lookup limit | Part of stopping people sending fake email as you. |
| DMARC | The policy, the reporting address and subdomain coverage | Tells receivers to block fakes, and reports who's trying. |
| DKIM & mail transport | Signing keys found, MTA-STS, TLS-RPT, DANE | Proves mail is yours and keeps it encrypted in transit. |
| Subdomains & takeover | Subdomains found in common names and certificate logs, dangling CNAMEs, exposed internal addresses | Forgotten subdomains are a common way into a business. |
| Hygiene & exposure | Leftover verification records, secrets in TXT records, wildcard records | Housekeeping that reduces what outsiders can learn or abuse. |
The findings people ask about most
| Finding | In plain English | Typical fix |
|---|---|---|
| No DMARC record Fix now · high | Nothing tells receivers to reject emails that fake your domain. | Publish a DMARC record starting at p=none with a reporting address, then tighten to quarantine and reject. |
DMARC is monitor-only (p=none)Improve · high | You're collecting reports but fakes are still delivered. This is a normal first step, not a mistake. | Read the reports, fix any legitimate sender that fails, then move to quarantine and reject. |
| No SPF record or multiple SPF records Fix now · high | Receivers can't tell which servers may send for you, or the duplicates make SPF fail outright. | One SPF record only, listing every legitimate sender. |
| SPF needs more than 10 lookups Fix now · high | SPF breaks for all your mail once you go over the limit. | Remove services you no longer use, or flatten some includes to IP ranges. |
| No CAA record Improve · medium | Any certificate authority may issue certificates for your domain. | Add CAA records naming the authorities you use. |
| DNSSEC not enabled Improve · medium | DNS answers for your domain can be forged on the network. | Switch it on at your DNS host, then add the DS record at your registrar. Do it carefully: a wrong DS record can take the domain offline. |
| No HSTS header or missing security headers Improve · medium | Browsers aren't told to insist on HTTPS or to block clickjacking and similar attacks. | Add the headers at your web server or CDN. The report gives the exact lines. |
| Certificate not trusted or about to expire Fix now | Visitors see a browser warning now, or soon will. | Renew it, install the full chain, and turn on automatic renewal. |
| Possible subdomain takeover Fix now · high | A subdomain points at a cloud resource that's been deleted, so someone else could claim it. | Delete the stale DNS record, or recreate the resource. |
| Zone transfer allowed or open resolver Fix now | Your DNS server hands out your whole zone, or answers questions for anyone. | Restrict transfers to your secondary servers and turn recursion off. |
| Mail server does not resolve Fix now · high | An MX points at a host that doesn't exist, so mail can bounce, and someone could register the name. | Correct or remove the MX record. |
When a finding isn't what it seems
DNS audits judge what's visible from outside, so a few findings need a human check:
- "No DKIM key found." DKIM selectors can be named anything, and nobody outside your mail provider can list them. The audit tries about 55 common names. If you do sign email, this item is a prompt to check an email's headers, not proof of a problem.
- "Transfer lock not shown." Some registries, including
.au, don't publish that status publicly. It appears as information, not a fail. - SOA serials differ between name servers. Normal for a few minutes after a change, and constant on very large providers. It's only a concern if it stays out of step for hours.
- Wildcard DNS. Flagged because it hides typos and makes takeovers harder to spot, but some setups genuinely need one.
- Domains that don't send email. The audit still expects SPF
-all, a null MX and DMARCp=reject. That's protective, not pedantic: scammers like unused domains. - Server-side tests unavailable. If our backend can't be reached, the web, certificate and name-server tests are skipped and the report says so. Run it again in a minute.
What to do after the audit
- Fix the "Fix now" items first, highest severity at the top of the Recommendations tab.
- Change one thing at a time and note what you changed. DNS changes can take up to an hour to spread, depending on the record's TTL.
- Take care with email changes. Tighten DMARC in steps, and keep reading its reports so you don't block a legitimate sender.
- Re-run the audit after each batch. The grade should go up, and any new red item points to something you just broke.
- Turn on monitoring. The box under the results emails you when something gets worse (a certificate nearing expiry, DMARC removed, a new risky subdomain), and when something gets fixed.
A real example: our own domainWhen we first ran DNS Audit on globalsoc.com.au it scored a D (67). Adding DMARC lifted it to C (74), and adding CAA records to C (78). What's left: DNSSEC, the HSTS and security headers that GitHub Pages can't set, and the old TLS version. We publish our own results because it's the best test of whether the advice is practical.
What the audit can't see
- Internal controls. Multi-factor authentication, patching, backups, endpoint protection and staff training don't show in DNS.
- Anything not published. The audit reads public records and makes standard, lightweight checks. It isn't a penetration test or vulnerability scan.
- Intent. A missing record might be an oversight or deliberate. Use your judgement, and ask your IT provider when unsure.
The audit is best used on your own domains. Reviewing someone else's beyond reading public records needs their written permission. For deeper background, see What your DNS records say about your business and DMARC explained.
Want a second pair of eyes?
We'll go through your report with you, fix the high-priority items and set up monitoring, with no jargon.
Run a free DNS Audit →Talk to Yogesh