DNS audit
Comprehensive DNS record audit, producing a structured report + an action list.
Inputs
- Domain name
- Expected email provider (Google Workspace, Microsoft 365, SMTP2Go, etc.)
- Whether the domain should accept email at all
Checks
| Record | Check | Best practice |
|---|---|---|
| A / AAAA | Resolves? TTL sensible? | TTL 300-3600 for active, 86400 for stable |
| MX | Matches expected provider? Priority correct? | One primary, optional secondary |
| SPF | Present? Provider includes correct? Ends with ~all or -all? |
-all preferred for production |
| DKIM | Selector(s) for provider? Key length 2048? | 2048-bit RSA |
| DMARC | Present? p=quarantine or p=reject? rua/ruf set? |
p=quarantine; sp=quarantine; rua=mailto:... |
| CAA | Limits cert issuers? | At least lets-encrypt + the active provider |
| NS | Matches expected registrar? | All NS records match |
Output
wiki/properties/websites/<domain>/audit-<date>.md with:
---
kind: dns-audit
domain: <domain>
audited_on: <date>
overall: pass | warn | fail
---
## Summary
[2-3 lines]
## Findings
[Per-record check result; flag warnings + failures]
## Actions
[Concrete fixes, ranked by urgency]
Anti-patterns
- Reporting "all good" without checking each record
- Recommending
p=rejecton DMARC for domains that haven't been monitored atp=nonefirst - Removing SPF without verifying current email senders