Tools / DNS Audit
What does your DNS tell a stranger?
Enter a domain and get a plain-English report on the records the world can see: private addresses that have leaked into public DNS, open zone transfers, email authentication that is not quite finished, certificate and DNSSEC settings, and the host names an intruder would look for first.
A · AAAA · CNAME · CAA · MX · NS · SOA · TXT · SRV · HTTPS · DNSKEY · DS · TLSAFree · No sign-up · Read-only
What it checks
Records that leak the inside
Every A, AAAA, CNAME, MX, NS, SRV and HTTPS answer is checked for RFC 1918 and other non-routable addresses, internal host names such as .local and .corp, and TXT records that carry addresses, paths, email addresses or anything shaped like a credential.
Zone transfers and delegation
Each name server is asked directly whether it is authoritative, whether the serials agree, whether the parent's delegation matches, and whether it will hand the whole zone to an unauthenticated AXFR request.
Email authentication
SPF syntax, qualifiers, lookup count and private ranges; DMARC policy, coverage and report addresses; DKIM keys under common selectors and their length; MTA-STS, TLS-RPT, DANE and BIMI.
Certificates and DNSSEC
CAA records and what they permit, DNSKEY and DS presence, algorithm strength, whether the chain of trust validates, and whether a stale DS is breaking resolution.
Host names an attacker would try first
A fixed list of a couple of hundred common names — VPN gateways, admin panels, staging systems, monitoring, hypervisors — plus wildcard detection and dangling CNAMEs that invite subdomain takeover.
Service records
Forty SRV names covering Active Directory, Kerberos, LDAP, SIP, XMPP, Matrix, mail autoconfiguration and more, with internal targets called out.
Why RFC 1918 matters
Addresses in 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are private: they are never routed on the internet, so a public DNS record that points at one cannot help a visitor. What it does do is describe the inside of the network to anyone who asks. It tells an attacker which subnets exist, which host names live on them, and often what each one is for; and it gives DNS-rebinding attacks a ready-made name that resolves to an internal address from inside your own browser.
These records usually arrive by accident: an internal zone copied into the public one, a split-horizon set-up that was never finished, a record created for a test and forgotten. They are also one of the first things a competent penetration tester lists, which is why this tool looks for them in every record type it can, including SPF terms, SRV targets, HTTPS hints and TXT text.
The audit is read-only and touches nothing but the public DNS, so it is safe to run against your own domain as often as you like. If it finds something you would like a second opinion on, talk to us; if you would like it run on every domain you own, every day, with an analyst watching the changes, that is part of the managed SOC.