Truvo Free Tools

DNS lookup and hygiene check

Your DNS records decide where your website and email go, who may issue certificates for your domain, and whether answers about it can be trusted. This lookup reads the public records, checks nameserver redundancy, CAA and DNSSEC, and names the SOC 2 and ISO 27001 controls each answer affects.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 A1.2ISO 27001 A.8.20ISO 27001 A.8.14ISO 27001 A.8.24
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the DNS lookup and hygiene check works

The lookup is passive: it reads your domain's public DNS records through DNS over HTTPS and never touches your servers.

01

Query

You enter a domain. The tool asks a public DNS over HTTPS resolver for the domain's nameserver, A, MX, TXT and CAA records, and for the DS record at the parent zone that shows whether the zone is signed.

02

Read

The result lists the records and three hygiene findings: how many authoritative nameservers answer for the domain, whether a CAA record limits which certificate authorities may issue for it, and whether DNSSEC is enabled.

03

Map

Each finding names the controls it speaks to. Nameserver redundancy maps to SOC 2 A1.2 and CC7.5 and ISO 27001:2022 A.8.14; CAA to CC6.1 and CC6.8 and A.8.24; DNSSEC to CC6.1, CC6.7 and CC7.2 and A.5.14 and A.8.20.

Found a gap? We fix it for you.

Truvo's security engineers harden DNS, mail and TLS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • Redundant nameservers

  • CAA records

  • DNSSEC signing

  • MX, SPF and DMARC

  • Audit evidence

  • Fixed-price scope

DNS lookup: frequently asked questions

It shows the records a domain publishes: nameservers, A records (where the website is), MX records (where email goes), TXT records (SPF, DMARC and verification strings) and CAA records (which certificate authorities may issue for the domain). This tool adds three checks on top: nameserver count, CAA presence and DNSSEC signing.

Nameserver redundancy maps to SOC 2 A1.2 and CC7.5 and ISO 27001:2022 A.8.14 (redundancy of information processing facilities) and A.5.30 (ICT readiness for business continuity). CAA maps to SOC 2 CC6.1 and CC6.8 and ISO A.8.24 (use of cryptography) and A.5.9. DNSSEC maps to SOC 2 CC6.1, CC6.7 and CC7.2 and ISO A.5.14 and A.8.20. The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The check queries public DNS over DNS over HTTPS for records your domain already publishes to the whole internet. Nothing connects to your servers and nothing is written or changed.

Every lookup for your domain, for the website and for email, starts at your authoritative nameservers. If there is only one and it goes down, the whole domain disappears from the internet until it comes back. Two or more nameservers, ideally with a second DNS provider on a separate network, remove that single point of failure. It is the kind of redundancy ISO 27001 A.8.14 asks about.

A CAA record names the certificate authorities allowed to issue TLS certificates for your domain, so a compromised or careless authority elsewhere cannot mint a trusted certificate in your name. DNSSEC signs your DNS answers so resolvers can detect forged responses that would send visitors to a copy of your site. At most registrars each is a record or a toggle.