.png&w=3840&q=75)
DNS3 min
How to Run a Complete DNS Audit on Your Domain Name
NS
NameSilo Staff7/9/2026
Share
To run a complete DNS audit, extract and validate your active domain zone file records. Use online lookup engines to trace your primary A records, check CNAME targets for dead endpoints, verify email MX server health, and ensure authentication strings like SPF and DKIM are fully aligned. Run audits at minimum quarterly.
What Is a DNS Infrastructure Audit?
A DNS audit is a systematic review of every record in your domain's zone file: not just what you remember adding, but everything currently live and resolving.
What an audit covers:
Record Type | What to Check |
A / AAAA | Correct IP, no orphaned entries |
CNAME | Target still exists and resolves |
MX | Mail servers active and reachable |
TXT | SPF/DKIM/DMARC valid, no duplicates |
NS | Correct nameservers, consistent globally |
Most DNS configuration errors are not from records you added incorrectly. They are from records you forgot to remove after decommissioning a service.
Why It Matters: Subdomain Takeover Exploits
When you cancel a SaaS tool, decommission a landing page, or migrate away from a platform, the cloud resource disappears. The CNAME record in your DNS often remains.
What happens next: An attacker claims the unclaimed resource (a deleted GitHub Pages site, expired Heroku app, or decommissioned S3 bucket). Because DNS still points there, visitors and session cookies scoped to *.yourdomain.com go directly to the attacker.
Common targets: GitHub Pages, Heroku, Netlify, Vercel, AWS S3, Azure App Service.
Old records from apps you no longer use are the primary attack vector.
Checking the Apex Map: A Records and CNAMEs
Step 1: Pull your current records Use MXToolbox DNS Lookup or dnschecker.org to extract all live records.
Step 2: Audit A records Verify each IP matches your current hosting provider. Any A record pointing to an IP you don't recognize or no longer control is a candidate for removal.
Step 3: Audit CNAME records (critical) Visit each CNAME target in a browser. If you see a service error ("There isn't a GitHub Pages site here", "No such app on Heroku"), the record is dangling and must be deleted immediately.
Use SecurityTrails for historical DNS if you're unsure when a record was added.
Checking Email Authentication Records
SPF (TXT record):
- Only one SPF record allowed. Two records invalidate both.
- Check lookup count: maximum 10 include: lookups permitted. Exceeding this causes SPF to fail.
- Use MXToolbox SPF Checker to validate.
DKIM: Verify selectors are active for each mail service. Rotate annually; abandoned selectors can be exploited.
DMARC: Confirm rua= inbox is monitored. Domains on p=none after 90 days should advance to p=quarantine or p=reject.
Checking Nameserver Delegation
Use MXToolbox NS Lookup to verify your nameservers and compare against your registrar's settings. Unexpected changes indicate account compromise. Check WHOIS at namesilo.com/whois to confirm registrar NS records match live DNS responses.
Common Mistakes
Leaving old TXT records: Outdated verification tokens from cancelled services accumulate silently and mask important records. Remove anything from platforms you no longer use.
Auditing only records you remember adding: Pull every record from your zone. You will find entries nobody on your team recalls creating.
What This Means for You
NameSilo's DNS Manager provides a full view of every record on your domain. Review and clean directly from your account dashboard. Check your domain status and global NS propagation at namesilo.com/whois.
Frequently Asked Questions
What is a DNS audit?
A systematic review of all active records in your domain zone file.
How do I find hidden or dead DNS records?
Use MXToolbox DNS Lookup or dnschecker.org to pull all active records.
What is a subdomain takeover vulnerability?
A dangling CNAME pointing to a deregistered third-party resource an attacker can claim.
How do I check if my DNS records are misconfigured?
Use MXToolbox, dnschecker.org, or SecurityTrails for full record validation.
What tools can scan my domain DNS?
MXToolbox, SecurityTrails, subzy, and dnschecker.org.
Should I clean out old TXT records?
Yes. Remove verification tokens and records from services you no longer use.
How do I verify my MX record paths?
MXToolbox MX Lookup confirms MX record health and server response.
Does NameSilo have an advanced DNS lookup tool?
WHOIS at namesilo.com/whois shows live NS records and domain status.
.png&w=2048&q=75)
NameSilo StaffThe NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
More articleswritten by NameSilo
