web.dnsDNS and email security
Checks the target's registrable domain for SPF, DMARC, CAA, MTA-STS and TLS-RPT records, no-mail lockdown, and dangling CNAMEs to takeover-prone services. Lookups use the system resolver. DNSSEC is not checked: Node's resolver cannot validate signatures, so any verdict would be a guess.
- Engine
- Built-in
- Targets
- URL
- Areas
- Security, Best practices
- Runs
- By default, when the target applies
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit https://example.com --only web.dnsBuilt into openaudit; nothing to install.