DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify the response hasn't been tampered with. Without DNSSEC, anyone between a resolver and the authoritative nameserver can forge DNS responses — including forging your SPF record, your MX, or your CAA record. DNSSEC is enabled at your domain registrar.

What is a CAA record and why does it matter?

CAA (Certification Authority Authorization) is a DNS record that restricts which certificate authorities are permitted to issue TLS certificates for your domain. Without one, any CA worldwide may issue a certificate for your domain — a real risk if a CA is compromised or an attacker obtains a fraudulent certificate. Adding a CAA record pinning to your actual CA takes under 5 minutes.

MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending mail servers to require valid TLS when delivering mail to you, and to refuse delivery if the TLS certificate is invalid or expired. Without MTA-STS, an active attacker can downgrade SMTP connections to plaintext and intercept inbound mail. It requires both a DNS TXT record and a policy file served over HTTPS at a specific path.

TLS-RPT (TLS Reporting) is a companion to MTA-STS. It's a DNS TXT record that tells sending mail servers where to email daily aggregate reports about TLS connection failures to your mail infrastructure. Without TLS-RPT, you have no visibility into whether senders are successfully establishing TLS or silently failing and deferring your mail.

What is BIMI and how do I enable it?

BIMI (Brand Indicators for Message Identification) lets your brand logo appear next to messages in supported mail clients — Gmail, Yahoo Mail, and Apple Mail. It requires DMARC at p=quarantine or p=reject, an SVG logo at a public HTTPS URL, and a DNS TXT record at default._bimi.yourdomain.com. Gmail additionally requires a Verified Mark Certificate (VMC). This tool checks the DNS record only.

How do I check my domain's security?

Type your domain into the box above and click "Check records". This free domain security checker queries live DNS in your browser and reports on DNSSEC (signed and validating), CAA (which certificate authorities may issue certs for you), MTA-STS and TLS-RPT (TLS protection and reporting for inbound mail) and BIMI (brand logo display) — no signup, no command line. For SPF, DKIM and DMARC, pair it with our email auth checker; for HTTP response headers, use the security headers check.

Is this domain security check free?

Yes. This domain security checker is free, needs no signup and no account, and the scan runs in your browser rather than on our servers — we never see the domain you check. There is no scan limit and no paid tier. It reports on DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI, which are the domain-level records a website security scan does not cover.

How often should I scan my domain?

Quarterly is enough for most organisations, because these records change rarely once set. Scan again immediately after any DNS migration, registrar transfer, certificate authority change or mail platform move — those are the events that silently drop a CAA or MTA-STS record. If you would rather not track it yourself, ongoing domain monitoring is part of our managed services.

What is the difference between a domain security check and a website security scan?

A domain security check looks at the records published in DNS for your domain — DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI — which govern who may issue certificates for you, whether inbound mail is protected in transit, and whether your DNS answers can be forged. A website security scan checks the site itself: TLS configuration, HTTP response headers, exposed paths and mixed content. They cover different layers, so a domain can pass one and fail the other. Run our website security scan alongside this one for the full picture.

All free toolsDomain security records

FREE TOOL

Domain security check.

Check any domain in one shot. This freedomain security checker runs a completedomain health check — aDNSSEC check, aCAA record check, and validation of MTA-STS, TLS-RPT and BIMI — the modern domain-security signals receivers and certificate authorities use to decide whether to trust you, and the ones most domains still don't have. New to the TLS side of it?MTA-STS setup guidecovers what the policy does and why a missing one lets an attacker downgrade your inbound mail to plaintext.

No signup · runs in your browser · also try oursecurity headers check,SPF/DKIM/DMARC checker,DNS lookup andMX lookup.

How to check your domain's security posture in 3 steps

1
Enter the domain in the box above (e.g. example.com.au) and click Check records.
2
Read the score. The summary shows how many of the five records — DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI — are configured, each marked PASS, WARN or FAIL.
3
Close the gaps. Fix anything flagged WARN or FAIL — enable DNSSEC at your registrar, add a CAA record pinning your CA, and publish an MTA-STS policy for inbound mail.

Domain security controls we check

Each control closes a specific gap in how the world trusts your domain's mail and certificates. Here's what each one does and why it matters.

Control	What it does	Why it matters
DNSSEC	Cryptographically signs your DNS records end-to-end from the root.	Without it, anyone in the network path can forge your DNS — including your SPF, MX and CAA records.
CAA	Restricts which certificate authorities may issue TLS certs for your domain.	No CAA means any CA worldwide can issue a cert for you — a real risk if a CA is compromised.
MTA-STS	Tells sending servers to require valid TLS for inbound mail, or refuse delivery.	Stops active attackers from downgrading inbound SMTP to plaintext and reading your mail.
TLS-RPT	Publishes where receivers should email daily TLS-failure reports.	Gives you visibility when senders silently fail to establish TLS and defer your mail.
BIMI	Publishes your verified brand logo for display in supported mail clients.	Improves recognition and trust in Gmail, Yahoo and Apple Mail — and requires strict DMARC first.
SPF / DMARC	Authenticate who may send as your domain and what to do with failures.	Table stakes for deliverability and anti-spoofing — checked by our companion email auth checker.

What this checks

DNSSEC

Cryptographic signing of DNS records, end to end from the root. Without DNSSEC, anyone in the path can forge DNS responses for your domain — including for SPF, DKIM, MX and CAA. We check theAD(Authenticated Data) flag from a validating resolver and look for DS + DNSKEY records.

CAA — Certification Authority Authorization

DNS records that restrict which certificate authorities may issue TLS certs for your domain. A missing CAA record means any CA worldwide may issue — fine for most, but a real risk if a third party with a CA's API key decides to issue*.yourdomain.com. We list the issuers you've authorised and anyiodefemail for misissuance reports.

MTA-STS — Strict Transport Security for SMTP

Tells receiving mail servers to require TLS when sending mail to you, and to refuse delivery if the certificate is invalid. Defends against active downgrade attacks on inbound mail. Needs both a TXT record at_mta-sts.{domain}and an HTTPS-served policy file (we check the DNS half here).

TLS-RPT — TLS Reporting

Companion to MTA-STS. Tells the world where to send daily aggregate reports about TLS connection failures to your mail servers — so you find out when receivers are downgrading or failing to deliver to you.

BIMI — Brand Indicators for Message Identification

Lets your verified brand logo appear next to messages in supported mail clients (Gmail, Yahoo, Apple Mail). Requires DMARC at p=quarantineor p=reject, an SVG logo URL, and (for Gmail) a Verified Mark Certificate. We check the DNS record only — the logo and VMC fetches happen inside the receiver's mail client.

These records are the next layer up

SPF, DKIM and DMARC (which ouremail auth checkercovers) are table stakes — every legitimate sender has them by 2026. DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI are what separate "configured correctly" from "configured for the modern threat model". Most domains have none of them. Adding them takes 30 minutes per record, and once they're in place, they reduce the attack surface substantially.

Talk to an engineer

Privacy

These lookups run in your browser against Cloudflare's public DNS-over-HTTPS endpoint. The domain you check is sent to Edos and recorded, along with your IP address and browser user-agent, and we may use that record to follow up about what the scan found. Plausible runs on every page here (cookieless, aggregate only); Google Analytics and Microsoft Clarity only load if you accept the consent banner. See ourprivacy policyfor retention periods and how to request removal.

Common domain-security gaps we fix

A domain-security check almost always surfaces the same handful of gaps. The ones we see most:

No DNSSEC

Unsigned DNS can be forged by anyone in the path — including your SPF, MX and CAA records. Enabling DNSSEC at the registrar closes it.

Missing CAA record

With no CAA, any certificate authority in the world can issue a cert for your domain. A CAA record pins issuance to the CA you actually use.

Weak or missing DMARC

A policy of p=none — or no DMARC at all — leaves your domain spoofable. Run the SPF/DKIM/DMARC check →

No MTA-STS

Without MTA-STS, an active attacker can downgrade inbound SMTP to plaintext and read your mail. A policy forces senders to require valid TLS.

Want your domain locked down end-to-end?

Edos Solutions configures and monitors the full domain-security stack for Australian organisations — DNSSEC, CAA, MTA-STS, TLS-RPT, BIMI and aligned SPF/DKIM/DMARC, done right and kept that way.

Explore website security Talk to us

References

RFC 4033, DNSSEC.
RFC 8659, CAA records.
RFC 8461, MTA-STS.

Frequently asked questions

What is DNSSEC?: DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify the response hasn't been tampered with. Without DNSSEC, anyone between a resolver and the authoritative nameserver can forge DNS responses — including forging your SPF record, your MX, or your CAA record. DNSSEC is enabled at your domain registrar.
What is a CAA record and why does it matter?: CAA (Certification Authority Authorization) is a DNS record that restricts which certificate authorities are permitted to issue TLS certificates for your domain. Without one, any CA worldwide may issue a certificate for your domain — a real risk if a CA is compromised or an attacker obtains a fraudulent certificate. Adding a CAA record pinning to your actual CA takes under 5 minutes.
What is MTA-STS?: MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending mail servers to require valid TLS when delivering mail to you, and to refuse delivery if the TLS certificate is invalid or expired. Without MTA-STS, an active attacker can downgrade SMTP connections to plaintext and intercept inbound mail. It requires both a DNS TXT record and a policy file served over HTTPS at a specific path.
What is TLS-RPT?: TLS-RPT (TLS Reporting) is a companion to MTA-STS. It's a DNS TXT record that tells sending mail servers where to email daily aggregate reports about TLS connection failures to your mail infrastructure. Without TLS-RPT, you have no visibility into whether senders are successfully establishing TLS or silently failing and deferring your mail.
What is BIMI and how do I enable it?: BIMI (Brand Indicators for Message Identification) lets your brand logo appear next to messages in supported mail clients — Gmail, Yahoo Mail, and Apple Mail. It requires DMARC at p=quarantine or p=reject, an SVG logo at a public HTTPS URL, and a DNS TXT record at default._bimi.yourdomain.com. Gmail additionally requires a Verified Mark Certificate (VMC). This tool checks the DNS record only.
How do I check my domain's security?: Type your domain into the box above and click "Check records". This free domain security checker queries live DNS in your browser and reports on DNSSEC (signed and validating), CAA (which certificate authorities may issue certs for you), MTA-STS and TLS-RPT (TLS protection and reporting for inbound mail) and BIMI (brand logo display) — no signup, no command line. For SPF, DKIM and DMARC, pair it with our email auth checker; for HTTP response headers, use the security headers check.
Is this domain security check free?: Yes. This domain security checker is free, needs no signup and no account, and the scan runs in your browser rather than on our servers — we never see the domain you check. There is no scan limit and no paid tier. It reports on DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI, which are the domain-level records a website security scan does not cover.
How often should I scan my domain?: Quarterly is enough for most organisations, because these records change rarely once set. Scan again immediately after any DNS migration, registrar transfer, certificate authority change or mail platform move — those are the events that silently drop a CAA or MTA-STS record. If you would rather not track it yourself, ongoing domain monitoring is part of our managed services.
What is the difference between a domain security check and a website security scan?: A domain security check looks at the records published in DNS for your domain — DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI — which govern who may issue certificates for you, whether inbound mail is protected in transit, and whether your DNS answers can be forged. A website security scan checks the site itself: TLS configuration, HTTP response headers, exposed paths and mixed content. They cover different layers, so a domain can pass one and fail the other. Run our website security scan alongside this one for the full picture.

Link to this tool

Found this useful? Link to it from your site, docs or a forum answer — copy the snippet below. It's a free tool, no attribution required, but much appreciated.

<a href="https://edos.com.au/tools/domain-security/">Free Domain Security Checker by Edos Solutions</a>

All free tools SPF/DKIM/DMARC checker HTTP security headers