DNS Forensic Auditor

DNS forensic auditing with DNSSEC validation, Subdomain Recon, MTA-STS/BIMI, WHOIS, SSL CT, GeoIP, & A-F grading.

DNS Forensic Auditor v2.0 — Advanced DNS Security Analysis DNS Forensic Auditor provides comprehensive DNS record analysis and security grading for any domain, directly from your browser. Scan the site you're visiting or enter any domain manually to get a full report instantly. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🏆 SECURITY SCORE (A–F GRADING) Get an instant security grade based on 13 checks across a 100-point scale: DNSSEC validation (AD flag, DS, DNSKEY, RRSIG) CAA record presence SPF and DMARC configuration DKIM key detection IPv6 support Subdomain takeover risk detection Nameserver redundancy and diversity SOA zone management Reverse DNS configuration Domain age verification SSL/TLS certificate validity Grade scale: A+ (95–100), A (85–94), B (70–84), C (55–69), D (40–54), F (0–39). Each check shows a progress bar with points earned. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔍 WHOIS / RDAP LOOKUP Look up domain registration details via the RDAP protocol: Registrar and registrant organization Creation, expiration, and last updated dates Domain age Status codes DNSSEC delegation signing status ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🛡️ DNSSEC VALIDATION Full DNSSEC analysis including AD flag verification, RRSIG extraction, DS and DNSKEY record detection, and complete chain of trust verification (DS → DNSKEY → RRSIG). ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📋 SOA RECORD ANALYSIS View the Start of Authority record: primary nameserver, administrator email, serial number, refresh/retry/expire intervals, and minimum TTL. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📊 DNS RECORD LOOKUP Query all major DNS record types: A, AAAA, CNAME, MX, NS, TXT, CAA, DS, DNSKEY, SOA. TXT records are automatically labeled as SPF, DMARC, or verification tokens. All queries use DNS-over-HTTPS via Google DNS. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ✉️ EMAIL SECURITY ANALYSIS Deep SPF analysis (policy, includes, authorized IPs), DMARC analysis (policy, subdomain policy, percentage, alignment, report addresses), and DKIM key detection with pass/fail indicators. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔄 REVERSE DNS (PTR) Automatic reverse DNS lookups for every A-record IP address, converting each IP to its corresponding PTR hostname. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🌍 GEOIP INTELLIGENCE IP geolocation for each resolved address including country (with flag), city, region, ASN, ISP, and coordinates. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔐 SSL CERTIFICATE TRANSPARENCY Recent certificates from CT logs including issuer, common name, validity dates, and expiry countdown. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚡ DNS PERFORMANCE Query latency measurement per record type with color-coded bars (green/yellow/red). ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🚨 SECURITY ANALYSIS DNSSEC status, CAA record check, and subdomain takeover risk assessment with PASS/WARN/FAIL alerts. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📜 SCAN HISTORY Last 20 scans saved locally. View past scans, click to rescan, or clear history. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📄 EXPORT OPTIONS Markdown — copy formatted report to clipboard PDF — download a dark-themed A4 report JSON — download raw scan data ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🎯 TWO SCAN MODES Active Tab — scan the domain of the website you're visiting. Manual Input — type or paste any domain. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔒 PRIVACY No personal data collected. Only the scanned domain name is sent to public APIs (Google DNS, ip-api.com, rdap.org, crt.sh). Scan history is stored locally and never transmitted. Version 2.0.0