DNS Security Test
The DNS Security Test inspects DNSSEC validation, resolver responsiveness, DNS record consistency and common misconfigurations on any domain. DNSSEC cryptographically signs DNS records so resolvers can verify the response was not tampered with — protecting against cache poisoning and DNS spoofing. The test also reports the speed and consistency of the authoritative name servers, which directly affects every visitor's first lookup time.
What This Tool Checks
- DNSSEC enabled and validating
- Authoritative name server count and geographic distribution
- Name server response time
- CAA record presence (controls which CAs can issue certificates)
- NS record consistency across all authoritative servers
- SOA record sanity (serial, refresh, expire)
- Common misconfigurations (lame delegation, missing glue records)
Why It Matters for SEO
DNS is the silent foundation of every web request. DNSSEC protects users from cache-poisoning and spoofing attacks that could redirect visitors to malicious sites. CAA records prevent unauthorised certificate issuance. Slow or inconsistent name servers add latency to every first visit. DNS misconfigurations are also common causes of mysterious "the site is down for some users" issues that take hours to diagnose without the right tooling.
How to Fix It
Enable DNSSEC at your registrar / DNS provider (Cloudflare, Route 53, Google Cloud DNS all support one-click enablement). Add a CAA record limiting which CAs can issue certificates for the domain. Ensure at least 2 geographically distributed name servers. Set sensible TTLs (1 hour for most records, shorter only when actively planning failover).
How It Works
We query each authoritative name server for the domain, validate any DNSSEC chain back to the root, and compare records across servers for consistency. Resolver response time is measured from multiple geographic regions to surface global DNS performance issues.
Common Mistakes to Avoid
- DNSSEC not enabled (vulnerable to cache poisoning)
- Single name server provider (single point of failure)
- CAA record missing (any CA can issue certs for the domain)
- Lame delegation (parent zone lists a name server that does not respond authoritatively)
- TTLs too long for fast failover or too short for caching efficiency
Quick Checklist
- DNSSEC enabled and validating
- CAA record present
- At least 2 geographically distributed name servers
- Consistent records across all authoritative servers
- TTLs sized for failover / caching trade-off