How to Run a DNS Security Check
A DNS security check is a free scan of your domain's DNS records that looks for the three big risks: hijacking (someone redirecting your domain), spoofing (someone sending email or hosting a fake site as you), and exposed records that hand attackers a map of your systems.
This guide is for site owners who don't know what DNSSEC, SPF, or a zone transfer is, but want to know in plain terms whether their domain is exposed, and what to do about it. You'll get five checks you can run today using free tools (no login required), plus how to read the results without a networking background.
What "DNS security" actually covers
DNS (Domain Name System) is the phone book that turns yourdomain.com into the IP address your browser actually connects to. If someone can tamper with that phone book, they can:
- Redirect your visitors to a fake copy of your site (DNS hijacking)
- Send email that looks like it's from you (spoofing), often used in phishing or invoice-fraud scams
- Take over an old subdomain you forgot about and host anything they want on it (subdomain takeover)
- Pull a full copy of your DNS records (a zone transfer) to map your infrastructure before an attack
The U.S. Cybersecurity and Infrastructure Security Agency has treated DNS tampering as serious enough to issue an emergency directive after a wave of real hijacking incidents, so this isn't a theoretical risk. CISA Emergency Directive 19-01 is worth a skim if you want the government's own account of how those attacks happened.
Step-by-step: run your own DNS security check
You need a browser, and for a couple of steps, a terminal. Mac and Linux have dig built in; Windows users can use nslookup or install dig through WSL.
1. Confirm your nameservers are who you think they are
Run:
dig NS yourdomain.comCompare the result to what's listed in your registrar account (GoDaddy, Namecheap, Cloudflare, etc.). If you see nameservers you don't recognize, your domain may already be hijacked, usually through a compromised registrar login rather than a DNS flaw itself.
2. Check your DNSSEC status
DNSSEC (DNS Security Extensions) cryptographically signs your DNS records so resolvers can detect tampering in transit. Paste your domain into DNSViz or Verisign Labs' DNSSEC Analyzer. A clean result shows a fully validated chain from the root down to your zone. Most small business domains come back "insecure" (no DNSSEC), which isn't an emergency but is a real gap. NIST SP 800-81-2, the government's DNS deployment guide, covers why this matters for preventing cache poisoning.
3. Test whether your DNS server allows a full zone transfer
A zone transfer (AXFR) is meant for syncing between your own nameservers, not for the public. If it's left open, anyone can download your entire DNS record set in one request. Test it:
dig axfr yourdomain.com @ns1.yourdnsprovider.comSwap in one of the nameservers from step 1. You want "Transfer failed" or "connection refused." If you get a full list of records back instead, that's a real, fixable misconfiguration: ask your DNS host to restrict AXFR to specific trusted IPs only.
4. Check your SPF, DKIM, and DMARC records (anti-spoofing)
These three TXT records tell mail servers worldwide which servers are allowed to send email as you, and what to do with messages that fail the check. Run your domain through /tools/email-spoofing to see all three explained in plain English instead of raw DNS syntax.
Quick manual version:
dig TXT yourdomain.com
dig TXT _dmarc.yourdomain.comNo DMARC record at all, or one set to p=none with no reporting, means spoofed email claiming to be you won't get blocked or flagged. It just lands in someone's inbox looking legitimate.
5. Look for dangling or forgotten subdomains
Old subdomains (blog.yourdomain.com, shop-test.yourdomain.com) that still point to a decommissioned cloud service (an old Heroku app, an expired S3 bucket, an unused Shopify CNAME) can be claimed by anyone who registers that same service name. This is called subdomain takeover. List your subdomains and check each one:
dig CNAME old-subdomain.yourdomain.comIf it points to a provider domain (herokudns.com, s3.amazonaws.com, and similar) you no longer actively use, remove the DNS record or re-claim the resource.
Free DNS security checkers worth using
| Tool | What it's good for | Login needed? |
|---|---|---|
| DNSViz | Visual DNSSEC chain-of-trust check | No |
| Verisign DNSSEC Analyzer | Plain DNSSEC pass/fail with explanation | No |
| MXToolbox DNS Lookup | General record lookup, blacklist check | No |
| Google Admin Toolbox Dig | Quick dig-style lookups in a browser | No |
| /tools/email-spoofing | SPF, DKIM, DMARC explained in plain English | No |
Running a domain through two or three of these, not just one, gives you a more reliable picture, since each tool tends to highlight slightly different issues.
Reading your results: what's actually urgent
Not every flag means panic. Use this rough priority order:
- Unrecognized nameservers or A records: act today. This usually means active hijacking.
- Open zone transfer (AXFR): fix this week. It's a reconnaissance gift to attackers, not necessarily an active breach yet.
- Missing or weak DMARC: fix this week to this month, especially if customers get invoices or password resets from your domain.
- Dangling subdomain pointing to an unclaimed service: fix this week. Low effort, real risk.
- No DNSSEC: plan it in. Most small sites run fine without it, but it closes a real gap once set up.
If several of these show up at once, or you're not sure whether something you found is actually exploitable, that's the point where a second pair of human eyes helps more than another automated scan. Our guide on how to tell if your website is hackable walks through the broader picture beyond DNS.
Key takeaways
- A DNS security check for a small business comes down to five things: nameservers, DNSSEC, zone transfer exposure, SPF/DKIM/DMARC, and dangling subdomains.
- Use
dig NS,dig axfr, anddig TXT(or their free online equivalents) to check your own domain in under 10 minutes. - An open zone transfer or a missing DMARC record is common and fixable, usually a DNS host setting, not a rebuild.
- Run checks through more than one free tool, since each one tends to catch different problems.
- DNS issues are easy to miss because the site "looks fine" while email or search traffic quietly gets hijacked underneath it.
When to bring in a human
Free scanners are great for catching the DNS-specific issues above, but they won't tell you if your contact form is injectable, your admin panel is exposed, or your WordPress plugins have a known vulnerability. That's a different, broader check. A manual website security audit from Bug Circuit starts at $49: a real person reviews your whole site, not just your DNS, and hands you a plain-English report with exact fixes, not just a pass or fail score. If you just want a free first read before spending anything, start with our free website security check.
A real human security engineer audits your whole site by hand and sends a full report: every issue, its severity, and the exact fix. From $49, with a 14-day money-back guarantee.
See pricing