Skip to content
RFC 10023 and the _for-sale TXT record: what it means for DNS securitySponsored byWhoisXML API
DNSAudit.io - Domain Security Scanner
Browser extension

DNS security and attack surface, for the tab you're on.

Click the icon on any site and DNSAudit reads its public DNS, then shows a quick snapshot across six tabs. One click takes you to the full graded report.

Add to Chrome Add to Firefox
Six tabs

What it checks

A fast factual read from public DNS, not a verdict. Hover any row to see the record behind it. The graded findings and fixes live in the full report.

Overview

A DNS security posture read by area, an exposure summary, and the last DNSAudit grade when the domain has been scanned before.

Email authentication

SPF with its qualifier and DNS lookup count, DKIM at common selectors, DMARC policy and reporting.

SPFDKIMDMARCMTA-STSTLS-RPT

DNS integrity

DNSSEC, the certificate authorities allowed by CAA, DANE, a wildcard check, and a DNS rebinding check that flags private IPs in public records.

DNSSECCAADANEWildcardRebinding

Infrastructure

Nameservers and their provider, IPv4 and IPv6, and the mail servers behind the domain.

Attack surface exposure

Integrations detected from TXT records, reverse DNS with the forward-confirmed check, and sensitive hostnames that resolve.

Raw records

Every record the domain publishes, grouped by type, with its TTL. Click a value to copy it.

AAAAAMXTXTNSCAA
Exposure tab showing integrations, reverse DNS and exposed hosts
Exposure

See what a domain puts on the internet

Forgotten hostnames that still resolve, third parties wired in through TXT records, and reverse DNS that does not forward-confirm all widen a domain's attack surface. The Exposure tab surfaces them straight from the tab you are on.

  • Exposed hosts. Common sensitive names such as admin, vpn or staging that resolve, tiered by risk.
  • Integrations. Vendors detected from verification records in TXT, so you can see who is wired into the domain.
  • Reverse DNS. The PTR record and whether it is forward-confirmed (FCrDNS).
Records tab listing raw DNS records with TTLs
Records

The raw records, right there

A dig-style view without opening a terminal. Every record grouped by type with its TTL, read live from public DNS. Click any value to copy it.

  • Grouped by type. A, AAAA, CNAME, NS, MX, TXT, CAA, SOA and SRV, each with its TTL.
  • Two resolvers. Queries go to Cloudflare over DNS over HTTPS, with Google as a fallback.
  • Copy on click. Grab any record value without selecting text.
How it works

From a tab to a report in three steps

01

Install the extension

Add it to Chrome or Firefox. No account, nothing to configure.

02

Open it on any site

Click the icon, or right click a domain or a link, to read its public DNS live.

03

Run the full scan

One button opens the graded report on DNSAudit.io, reusing the last scan when there is one.

Reads public DNS. Nothing else.

No account
No page content
No browsing tracked
Only the domain you choose
FAQ

Questions, answered

Is the extension free?
Yes. The quick DNS look is free and needs no account. Running the full scan on DNSAudit.io uses the same free daily scans as the website.
What data does the extension collect?
It reads only the domain of the tab you choose. It does not read page content, does not track the sites you visit, and sets no cookies. To look up a domain it sends that domain to Cloudflare's public DNS over HTTPS resolver, and to DNSAudit.io when you ask for a cached grade or the full report.
How is the quick check different from the full scan?
The quick check shows live facts from public DNS, with no verdict. The full scan on DNSAudit.io grades every finding with a severity and gives a recommended fix.
Which DNS resolver does it use?
Queries go to Cloudflare over DNS over HTTPS, with Google as a fallback when Cloudflare is blocked or does not respond.
Can I check a domain that is not the current tab?
Yes. Right click a domain in a page, or a link, and choose the quick DNS look.
Does it slow down my browsing?
No. It does nothing until you open it on a tab or use the right click menu. There is no background monitoring.
What does it actually check?
Email authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT), DNS integrity (DNSSEC, CAA, DANE, wildcard, DNS rebinding), infrastructure (nameservers, IPs, mail servers), attack surface exposure (integrations, reverse DNS, exposed hosts), and the raw DNS records with their TTLs.

Check a domain in one click

Free, and the quick look needs no account.

Add to Chrome Add to Firefox