Free DNS Security Check

Free DNS Security Check

Free tool

Check DNSSEC, CAA records, wildcard exposure, and subdomain takeover risks in 60 seconds. Stops hijacking and rogue cert issuance before attackers find the gap.

  • DNSSEC & CAA
  • Wildcard review
  • Cache poisoning risks
No credit card requiredProduction-safe (100% passive)No setup or code required
Trusted by 3,500+ security & engineering teams
Oracle logoShopify logoGoDaddy logoChubb logoToshiba logoMAPFRE logoBelfius logoGBG logoWEKA logoShift Technology logo

What you get for free

18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.

What Essential adds at $39/mo

+17 advanced checks, continuous monitoring, daily security score history, email alerts, GitHub SAST, board-ready PDFs, SOC 2 / ISO 27001 / PCI reports.

How to improve DNS security

DNSSEC Implementation:
  • Enable DNSSEC at your domain registrar or DNS provider
  • Generate and configure DNSKEY records
  • Publish DS records with your registrar
  • Monitor DNSSEC chain of trust regularly
CAA Record Configuration:
  • Add CAA records to control certificate issuance
  • Specify authorized Certificate Authorities
  • Configure wildcard certificate policies
  • Set up violation reporting (iodef)
DNS Security Hardening:
  • Remove unnecessary wildcard DNS records
  • Implement proper TTL values to prevent DNS rebinding
  • Secure subdomains to prevent takeover attacks
  • Monitor DNS changes and anomalies

Why DNS Security Matters

Attack Prevention:
  • Prevents DNS hijacking and cache poisoning attacks
  • Protects against subdomain takeover vulnerabilities
  • Reduces risk of certificate mis-issuance
  • Mitigates DNS-based DDoS amplification attacks
Data Integrity:
  • Ensures DNS responses haven't been tampered with
  • Validates authenticity of DNS records
  • Provides cryptographic proof of DNS data integrity
  • Protects against man-in-the-middle DNS attacks
Compliance & Trust:
  • Meets security compliance requirements
  • Enhances user trust and confidence
  • Demonstrates security best practices
  • Reduces liability from security incidents

What this checker validates

DNSSEC Validation:
  • DNSSEC detection (DNSKEY, RRSIG, NSEC, NSEC3, DS records)
  • DS (Delegation Signer) record presence in parent domain
  • Basic chain of trust validation for DNSSEC records
Certificate Authority Authorization (CAA):
  • CAA record presence detection
DNS Security Risks:
  • Wildcard DNS record detection and exposure analysis
  • DNS amplification vulnerability assessment (ANY query responses)
  • Cache poisoning vulnerability testing (predictable transaction IDs)
  • DNS rebinding vulnerability detection (short TTL values)
  • Comprehensive subdomain takeover vulnerability detection
DNS Configuration Analysis:
  • TTL (Time To Live) minimum value analysis
  • Subdomain takeover vulnerability detection

Across 1,409 recent DNS checks, 100% have at least one gap in DNSSEC or CAA records. DNS posture is the most-overlooked surface in production security.

Implementation examples

Once you've identified the gap, applying the fix is straightforward. Here are the three configurations developers reach for most often to lock down certificate issuance with CAA records.

BIND zone file

$TTL 3600
example.com.   IN  CAA  0 issue "letsencrypt.org"
example.com.   IN  CAA  0 issuewild ";"
example.com.   IN  CAA  0 iodef "mailto:security@example.com"

Cloudflare API

POST /client/v4/zones/{zone_id}/dns_records
{
  "type": "CAA",
  "name": "example.com",
  "data": { "flags": 0, "tag": "issue", "value": "letsencrypt.org" },
  "ttl": 3600
}

AWS Route 53 (change-resource-record-sets)

{
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "example.com.",
      "Type": "CAA",
      "TTL": 3600,
      "ResourceRecords": [
        { "Value": "0 issue \"letsencrypt.org\"" },
        { "Value": "0 issuewild \";\"" },
        { "Value": "0 iodef \"mailto:security@example.com\"" }
      ]
    }
  }]
}

Tool-specific questions

What is DNSSEC and why is it important?

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, ensuring data integrity and authenticity. Our checker detects the presence of DNSSEC records (DNSKEY, RRSIG, NSEC, NSEC3, DS) and validates basic chain of trust, which helps prevent DNS hijacking and cache poisoning attacks.

How do I enable DNSSEC for my domain?

Enable DNSSEC at your domain registrar or DNS provider, generate DNSKEY records, and publish DS (Delegation Signer) records with your registrar. The process varies by provider, but most offer automated DNSSEC setup. Expect some propagation time for full deployment.

What are CAA records and how do they improve security?

CAA (Certificate Authority Authorization) records specify which Certificate Authorities can issue SSL/TLS certificates for your domain. Our checker detects the presence of CAA records, which is the first step in preventing unauthorized certificate issuance and reducing the risk of certificate-based attacks.

What's the difference between DNS and DNSSEC?

DNS is the system that translates domain names to IP addresses. DNSSEC adds cryptographic signatures to DNS records, ensuring the data hasn't been tampered with. While DNS provides the service, DNSSEC provides the security layer to protect against attacks.

Can DNSSEC impact website performance?

DNSSEC can slightly increase DNS response sizes due to cryptographic signatures, but the performance impact is minimal for most websites. The security benefits far outweigh the small performance cost, and modern DNS infrastructure handles DNSSEC efficiently.

What are wildcard DNS records and why are they risky?

Wildcard DNS records (*.domain.com) resolve any subdomain to the same IP address. While convenient, they can expose unintended services, enable subdomain takeover attacks, and make it harder to track legitimate subdomains. Use specific records when possible.

How often should I review my DNS security configuration?

Review DNS security settings quarterly or after any infrastructure changes. Monitor for unauthorized DNS changes, check DNSSEC chain of trust, and verify CAA record compliance. Use Barrion's continuous monitoring to track DNS security posture over time.

What's DNS cache poisoning and how does DNSSEC prevent it?

DNS cache poisoning occurs when attackers inject false DNS records into DNS caches. DNSSEC prevents this by cryptographically signing DNS records, making it impossible to forge responses without the private key. This ensures users receive authentic DNS data.

What is subdomain takeover and how does your checker detect it?

Subdomain takeover occurs when a subdomain points to a service that no longer exists, allowing attackers to claim it. Our checker performs comprehensive subdomain takeover detection by identifying subdomains that point to abandoned services, expired domains, or unclaimed cloud resources.
Why Barrion

Built for the engineers who already have enough to fix.

Speed

Real-time results

Instant analysis with a detailed report. You see findings as the scan runs, not after.
Coverage

Comprehensive checks

35+ checks per scan covering TLS, headers, CORS, cookies, DNS, email auth, and more, in a single pass.
Action

Step-by-step fixes

Every finding ships with the exact remediation step for your framework. Hand it to the engineer who owns the surface.
Other tools

More free checks, for the rest of your surface.

Complete Security Scan

Complete website security analysis with comprehensive vulnerability detection

Pre-Pentest Security Scan

Passive scan that catches the misconfigurations a pentester finds first. Use it before a manual engagement to clear the easy issues.

Security Compliance Checker

Check compliance with PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR. Get compliance readiness reports.

WAF Checker

Detect Web Application Firewall presence through passive header analysis. Identify WAF/CDN providers.

Security Headers Test

Check your website's HTTP security headers configuration

TLS/SSL Security Checker

Validate your SSL/TLS configuration and certificate setup
Browse all security tools →
Related guides

Go deeper on the same topic.

Learn

Caa Records

Per-check explainer covering what it is, why it matters, and how Barrion verifies it.
Guide

Spf Dkim Dmarc Guide

Long-form implementation guide from the Barrion engineering blog.
FAQ

Frequently asked.

What is Barrion and how does it enhance website security?
Barrion is a security testing and monitoring platform for engineering teams, covering three products: passive DAST that continuously watches your live web apps and APIs, SAST via GitHub that scans your codebase for secrets, insecure patterns and vulnerable dependencies, and AI pentesting that runs active, agent-driven attacks with proof-of-exploit. Findings come with step-by-step fixes you can ship immediately.
How safe is Barrion to use for security testing?
Every default Barrion scan is 100% passive and read-only. We never submit forms, brute-force endpoints or interact with state-changing routes, so it's safe to run against production.
What types of security issues does Barrion identify?
Barrion is a security testing and monitoring platform, so coverage spans three surfaces. Passive DAST flags misconfigurations across TLS/HTTPS, security headers, cookie flags, CORS policy, DNS records, email authentication (SPF/DKIM/DMARC), network exposure and common web hygiene issues. SAST via GitHub finds secrets in code, insecure patterns and vulnerable dependencies. AI pentesting adds exploitable findings like SQL injection, XSS and broken access control with proof-of-exploit.
What specific security checks does Barrion perform?
Barrion checks TLS/HTTPS configuration, HTTP security headers, cookie flags, CORS policy, DNS and email authentication records, network exposure and common web hygiene issues, then prioritises them by severity with clear remediation.
What is Barrion's smart crawling?
Smart crawling automatically discovers the pages and endpoints of your app so scans cover the surface that matters, without you manually listing every URL.
How often does Barrion perform security scans?
Manual scans on demand. Continuous monitoring runs automatically on Essential (weekly+) and Business (daily), and alerts you the moment a new issue appears.
Is Barrion suitable for security testing of all business sizes?
Yes. Barrion is a security testing and monitoring platform, with passive DAST, SAST via GitHub and AI pentesting available to solo developers, startups, scale-ups and enterprise security teams alike, without adding headcount.
How does Barrion handle data security and privacy during security testing?
Scans are passive and read-only by default, and we never store or expose sensitive data from your application. Pentests are rate-limited and non-destructive, designed to confirm exploitability without altering data or affecting availability.
What if I'm not satisfied with Barrion's security testing service?
Paid plans start with a free trial, and you can cancel anytime. If something isn't right, contact us and we'll make it work for your team.
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Barrion produces audit-ready PDF and CSV reports suitable for SOC 2, ISO 27001, PCI DSS and NIS2, ready to share with auditors, customers and your board.

Anything else? Email contact@barrion.io.

Run a full report on your site.

Free first scan covers every check, no signup needed. Sign up to save the report and turn on continuous monitoring.

Get free reportSee pricing