Free DNS Record Lookup & DMARC / SPF Validator

Verify your domain's DNS zone health, inspect A/AAAA/MX/TXT records, validate SPF 10-lookup limits, test DMARC enforcement policies, and prevent malicious domain spoofing.

Lookup DNS & Validate
DNS Zone Inspector v3.2Email Defense: Strict

$ wesecurex-dns --verify-email-auth --domain example.com

[PASS] DMARC Record: "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc@example.com"

[PASS] SPF Record: "v=spf1 include:_spf.google.com ~all" (2/10 DNS lookups used)

[PASS] MX Gateway: 5 inbound mail servers verified with valid TLS handshakes

[PASS] DNS CAA Record: "0 issue \"letsencrypt.org\"" active

[PASS] Dangling CNAME Check: Zero dangling aliases detected (No Subdomain Takeover)

[RESULT] 100% Phishing & Spoofing Immunity Verified

Essential DNS Records for Web & Email Security

A & AAAA

Maps hostname to IPv4 (32-bit) and IPv6 (128-bit) addresses.

MX (Mail Exchange)

Directs incoming email traffic to designated mail gateway servers with priority ranking.

TXT (SPF / DMARC)

Contains cryptographic verification keys and email anti-spoofing enforcement rules.

CNAME

Canonical alias pointing one hostname to another. Vulnerable to Subdomain Takeover if dangling.

CAA

Restricts which Certificate Authorities can issue SSL certificates for your domain.

NS (Nameserver)

Delegates authoritative DNS control for the domain zone.

Need Automated Continuous Audits?

Upgrade from Single-Check to External Attack Surface Reconnaissance (EASM)

24/7 continuous discovery of subdomains, open ports, and shadow IT. Scale with automated schedules, Slack alerts, 150+ monthly credits, and compliance PDF exports on our paid tiers.

Subdomain discovery via Certificate TransparencyFull 65,535 TCP/UDP port mappingSSL/TLS certificate expiration monitor
Explore Paid Plans (from $9/mo)Launch Free Instant DAST Scan

Frequently Asked Questions

Why is a strict DMARC policy essential for domain reputation?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) allows domain owners to instruct receiving mail servers what to do if an email fails SPF or DKIM checks. A policy of 'p=reject' prevents cybercriminals from spoofing your domain in CEO fraud and phishing campaigns, protecting both your brand and your email deliverability.

What is the 10-lookup limit in SPF and why does it cause deliverability failures?

RFC 7208 mandates that evaluating an SPF record must not require more than 10 DNS lookups (from 'include', 'a', 'mx', 'ptr', and 'redirect' mechanisms). Exceeding this limit causes receiving servers to return an SPF 'PermError', causing legitimate corporate emails to land in spam folders.

What is a DNS CAA record and why does SSL security depend on it?

A Certification Authority Authorization (CAA) DNS record specifies which Certificate Authorities (such as Let's Encrypt or DigiCert) are permitted to issue SSL/TLS certificates for your domain. CAA records prevent unauthorized third parties from obtaining fraudulent certificates even if a rogue CA is compromised.

How does WeSecureX automate DNS posture monitoring?

WeSecureX monitors your DNS zone files continuously to detect unauthorized changes, subdomain takeover dangling CNAMEs, expired nameserver delegations, and degraded DMARC alignment before attackers exploit them.