DNS Security Checker

Check public DNS records for security-relevant configuration issues that can affect email trust, domain ownership, and web asset routing.

Check DNS security records Read docs

Problem Summary

DNS controls how users and services find a domain. Stale records, missing email authentication records, broad TXT records, or unexpected hostnames can create operational and security risk.

Why It Matters

DNS changes can expose forgotten services or send users to the wrong infrastructure.
Email authentication records such as SPF, DKIM, and DMARC help receiving systems evaluate mail that claims to come from a domain.
Security teams need a repeatable way to notice public DNS drift.

How Qourby Checks It

Queries public DNS records that are relevant to web and email security posture.
Highlights missing or weakly configured records where an external check can make a reliable observation.
Records DNS answers so teams can compare them with the intended source of truth.
This does not replace manual domain inventory, registrar review, or takeover testing.

Basic scanning checks externally observable configuration and response behavior. Manual penetration testing goes further with authenticated flows, exploit validation, source review, business logic testing, and human judgment.

Common Failures

No DMARC record on a domain that sends email.
SPF record too broad or split across multiple TXT records.
Stale CNAME records pointing at retired platforms.
Unexpected A or AAAA records for production hostnames.
Verification TXT records left in place after a vendor workflow is complete.

How To Fix

Review DNS records against the services that should currently use the domain.
Publish one SPF record and remove obsolete senders.
Add DMARC with a policy that matches your current mail readiness.
Remove stale CNAME, TXT, A, and AAAA records after confirming they are unused.
Track DNS ownership and change approvals for production domains.

Related Checks and Guides

Scanner check