Skip to content

DNS Inspector

SysSeder / DNS & email configuration

See what your domain publishes.

Inspect public DNS records, DNSSEC resolver signals and email-policy discovery. Get a transparent configuration-signal score — with unknowns kept visible.

This is an online lookup. Clicking Inspect sends the domain, selected DKIM name and derived DNS query names to Google Public DNS, which also sees your connection IP. Use public, non-sensitive names only. No lookup happens until you submit. This tool has no account, API key or paid backend, and does not store your queries; Blogger and Google's own privacy practices still apply.

Domain only, not a URL. No paths, passwords, tokens, ports, IP addresses or internal names. ASCII/Punycode accepted. Enter the actual mail domain, not automatically its www host. Choose deliberately. The no-email profile checks explicit no-mail signals; missing MX does not mean a domain cannot receive email. Profiles have different editorial weights and are not comparable security grades. Get the selector from your mail provider or a message's DKIM-Signature s= value. We do not guess or enumerate selectors. Leave blank to show DKIM as unknown.

Ready. No DNS queries have been sent.

How the 0–100 score works

Confirmed points, not a security grade. SysSeder's editorial rubric counts limited observable configuration signals. Unresolved points earn nothing confirmed, but are shown separately, never silently treated as failures or passes. Coverage is the share of score weight this tool could resolve, not the percentage of all security checks performed. Potential range = confirmed points through confirmed + unresolved points. A fully covered score still excludes the deeper tests below.

  • Email profile: DNSSEC resolver authentication 25; SPF 20; direct DMARC 30; supplied DKIM selector 15; MTA-STS TXT discovery 5; TLS reporting TXT discovery 5.
  • SPF: 5 for a unique version candidate, 5 for supported local syntax, up to 5 for terminal policy (-all 5, ~all 3, neutral/permissive 0), 5 for no DNS-lookup terms in the supported ip4/ip6/all subset. Includes, redirects, macros and other mechanisms leave the latter 15 points unresolved. This is not a full SPF evaluator.
  • DMARC: 10 for a single direct record passing basic local parsing, plus requested policy reject 20 / quarantine 10 / none 0; absent p defaults none. RFC 9989 t=y reduces requested action; obsolete pct is not scored. No direct record means inherited policy is unresolved, not absent.
  • DKIM: 5 for one nonempty key candidate at your selector; the other 10 remain unresolved because cryptographic key and signature validation are not implemented. An empty p= denotes revocation. One selector is not all DKIM.
  • No-email profile: DNSSEC 35, exactly one SPF v=spf1 -all record 25, direct DMARC reject (not reduced by t=y) 30, sole Null MX (0 .) 10. DKIM and transport discovery are not applicable and not queried in this profile.
  • DNSSEC: points mean Google returned AD=true with checking enabled for at least one ordinary query (not DS/DNSKEY) at the input name, including authenticated negative answers. AD=false is unresolved, not automatically unsigned or bogus. SERVFAIL has multiple possible causes. DNSKEY/DS presence alone is not validation.

Transport-discovery points mean only basic matching TXT structure. They do not prove MTA-STS HTTPS policy validity, reporting authorization, TLS support or delivery enforcement. Optional protocol absence is not proof a domain is insecure. Do not enforce reject or change production DNS just to raise a score.

What this inspector cannot establish
  • No complete zone, subdomain or DKIM-selector enumeration. Standard queries: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, DNSKEY and DS at the exact input; derived mail TXT names are listed in results.
  • No independent DNSSEC chain/rollover/algorithm audit. Authenticated NXDOMAIN proves nonexistence, not a working domain. DS at a non-zone-apex hostname can legitimately be empty.
  • No recursive SPF expansion, lookup-limit audit, sender authorization or message-alignment test. DMARC is direct-record only: no RFC 9989 tree-walk or organizational-domain inference.
  • No DKIM signature verification or key-strength test. No SMTP connection, TLS scan, DANE/TLSA verification, HTTPS MTA-STS policy fetch or reporting endpoint authorization. Browser CORS may block arbitrary policy fetches; this tool does not work around that with a proxy.
  • CAA is advisory: absence at this name is not proof issuance is unrestricted, because parent/alias processing can apply. A CAA record is not certificate validation. Missing IPv6 is not automatically a security flaw.
  • One public recursive resolver's cached view, not a global propagation test. TTL is remaining cache lifetime; results can vary by resolver, time, delegation and location. Wildcards and aliases can affect responses. Queries do not connect to the inspected domain's returned IP addresses.
Sources & privacy

Protocol references reviewed 24 October 2026. Score weights are SysSeder's heuristic, not prescribed by these standards.

Queries use HTTPS, omit credentials and referrer, and request EDNS Client Subnet 0.0.0.0/0. This does not hide your IP from Google. Results remain in this page's memory until reload; Copy uses your clipboard only when clicked.

Back to practical tools · Explore the Learning Lab

Post a Comment