Table of Contents
DNSAudit.io 1.3 is live. The main addition is the Domain Exposure Engine, which looks at registration and ownership risk alongside the DNS checks you already run. There's also 14 new security checks across SPF, DMARC, DKIM, and TLS-RPT, a free account with a domain dashboard, provider imports, and an official Python SDK.
Here's the rundown.
Domain Exposure Engine
Until now a scan told you about your DNS configuration. The Domain Exposure Engine adds a second layer: the registration and ownership side of a domain.
It runs 26 checks across areas like:
- Domain expiration, imminent expiry, redemption, and pending-delete states
- Registry and registrar locks
- Registrar risk and accreditation
- Recent updates and transfers
- Domain age and newly registered domains
- Excessive registry status flags
- Nameserver redundancy
- DNSSEC signing status
- High-risk TLDs and internationalized domain names
- WHOIS privacy exposure and exposed registrant contact information
You get a dedicated Domain Exposure Score from 0 to 100 alongside your DNS Security Score, with separate Issues and Passed Tests views so you can see what fired and what didn't. There are also WHOIS and WHOIS History views, and repeat lookups are cached so they load faster the second time.
The result page has been redesigned to show both scores at a glance. DNS Security and Domain Exposure sit side by side at the top, with a summary of records scanned, subdomains found, and checks run.
Free account, full dashboard
Creating an account gets you more scanning room and a place to keep track of everything you scan. No credit card, free forever.
The free plan includes:
- 10 scans per day
- Up to 100 subdomains per domain
- 14 days of scan history
- Advanced mail security checks
- Full Domain Exposure Engine results
- PDF, JSON, and CSV exports
- Multi-factor authentication
Anonymous scanning still works when you just need a quick check.
Once you're in, the dashboard is built around your domains. The home view shows your recent scans, your top priority issues, and an average score across everything you track.
Bring your domains in from wherever they live
This is the part I'd point you to first. Instead of adding domains one at a time, you can import them in bulk. Add a single domain with tags and notes, paste a list, upload a zone file or a CSV, or pull them straight from your DNS provider.
Providers you can import from today: Cloudflare, Amazon Route 53, Google Cloud DNS, Azure DNS, GoDaddy, DigitalOcean, Linode, Gandi, and NS1.
From the list you can star the domains you check most so they stay pinned to the top, filter down to starred only, and select several at once to scan, tag, export, or delete them together.
Scan history and top issues
Scan History keeps each scan with its grade, score, and a rescan button, so you can come back and re-run any domain without retyping it.
Top Issues pulls the open findings from the latest scan on each domain into one list. You can see criticals and warnings across your whole inventory at once and filter by domain or category.
Better subdomain visibility
Subdomain results now show First Seen and Last Seen dates where we have them, so you can tell which hostnames are new and which have been around for a while.
We also fixed cache handling: resetting a domain's subdomain cache now reliably pulls fresh data instead of holding on to stale entries.
New email security checks
1.3 ships 14 new checks across SPF, DMARC, DKIM, and TLS reporting.
On the SPF side: policy termination, lookup-limit risk, void lookups, overly permissive mechanisms, risky or deprecated mechanisms, syntax hazards, and wildcard subdomain protection.
On the DMARC side: record validity, enforcement strength, subdomain policy, reporting and alignment configuration, and unknown or unsupported tags.
Rounding it out: DKIM selector and key validation, and TLS-RPT record checks.
Python SDK
There's now an official Python SDK for the API. It covers scanning, PDF and JSON exports, and scan history, with both sync and async clients. It also handles daily quotas and burst limits for you: when the API returns a 429 it reads the Retry-After value, waits, and retries, so you don't have to write that logic yourself.
Install it with pip:
pip install dnsauditRequires Python 3.8 or newer. Source, examples, and docs are on GitHub.
Improved API access
If you're building on top of DNSAudit.io, a few things got easier:
- Published OpenAPI documentation
- Machine-readable API discovery through the API catalog
- API docs and download links in one place
- More consistent response structures
You create and manage API keys from the dashboard, and there's a stats view for request counts, quota, and errors so you can keep an eye on usage.
If you are part of a security team, request your earlier API access.
Bug fixes
A batch of fixes so results line up with what's actually there:
- Scan summary counts now match the issues reported
- Removed duplicate DMARC warnings
- Removed duplicate gated SPF results
- SPF records using
redirect=are evaluated per RFC 7208 - No more SPF termination warning when a redirect target ends in a valid
allmechanism - IPv6 findings use shorter, clearer titles
- More consistent severity and presentation across findings
Thanks
A lot of these changes came from people who scanned, hit an edge case, and told us about it. If you sent feedback or reported something odd, thank you. It made the product better.
Stay tuned. 1.4 is already in the works, and there's some crazy stuff coming.
