DNS security checklist
Eight things every business domain should have. The scan checks all of them automatically.
1. Registrar lock on
Enable the transfer lock (clientTransferProhibited) at your registrar, turn on 2FA for the registrar account, and keep the expiry date auto-renewing on a card that won't lapse.
2. At least two nameservers, different networks
One NS is a single point of failure for everything. Serious DNS hosts give you 2–4 anycast nameservers by default.
3. DNSSEC enabled
Signs your DNS answers so resolvers can detect tampering. One click at most modern DNS hosts; make sure the DS record lands at the registrar.
4. CAA record published
Limits which certificate authorities can issue for your domain, e.g. 0 issue "letsencrypt.org".
5. Email authentication (even without email)
SPF, DKIM and DMARC on sending domains; v=spf1 -all and p=reject on domains that never send. Parked domains get spoofed too.
6. No CNAME at the apex
Use your provider's ALIAS/flattening feature instead, apex CNAMEs break mail and other records.
7. Clean up stale records
Old verification TXTs, dead MX hosts, and A records pointing at decommissioned servers (subdomain takeover risk).
8. MTA-STS + TLS-RPT for mail domains
Require TLS for inbound mail and get reports when encrypted delivery fails.