Domain, DNS and email security
Are your domain and email infrastructure properly protected? Your site is more than the pages a browser shows. Your domain, DNS and email setup also carry important security and reliability signals.
Try our method for free
One page. One pillar. A real report.
Enter your website and we’ll email you a report on Domain & network for your home page. Please allow at least 24 hours.
Our plans cover the 9 pillars across the pages of your whole site.
What we check
- The expiry date of your domain name, and the setting that forbids its transfer until someone lifts it at your registrar.
- The name servers: how many there are, how diverse they are, and, where DNSSEC is used, whether the zone is signed to protect DNS response integrity.
- The records that do, or do not, allow a third party to email your customers in your name (SPF, DKIM, DMARC). They are read down to the detail: a record that is present but incomplete protects nothing while looking in place, which is worse than a plain absence.
- CAA records, when published, which restrict which certificate authorities are allowed to issue certificates for your domain.
- Your exposed subdomains, some of which may still point to an abandoned service that a third party can claim.
- Where your addresses resolve, at which operator, and on which network.
What we find on the sites we audit
Across about 20 to 30 websites we audited between August 14, 2026 and September 24, 2026:
- 75% haven't signed their DNS zone (DNSSEC)
- 10% receive email with no SPF or DMARC record protecting their name
- 15% had a domain name less than 90 days from expiry
Each percentage covers the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.
See also: website security audit; a real business website report.
On what basis
SPF (RFC 7208) · DKIM (RFC 6376) · DMARC (RFC 9989) · DNSSEC
A finding is only worth something if it rests on an identifiable basis. Where one exists, we rely on a law, a standard or a specification, and for every point recorded the report names the page and gives the value we measured.
What it changes for you
This is the quietest pillar. A domain that expires cuts off the site and the mail. A mail service without protection lets a third party write to your customers in your name.
These settings are not fixed in the site: they live at your registrar, and nobody looks at them as long as everything works.
The weight of this pillar
An overall score has to weigh what matters for your business: the 9 pillars do not carry the same weight depending on what your site is for. Here is what “domain & network” represents in the overall score, under each weighting. The report always states which one produced your score.
| Type of site | Share of the overall score |
|---|---|
| Type not determined | 6% |
| Business / brochure site | 4% |
| E-commerce site | 6% |
| Application / customer portal | 8% |
| Blog / media site | 4% |
| Public-sector site | 5% |
This pillar is examined alongside the other eight in every plan, whatever the number of pages. See pricing →
Guides for this pillar
DNSSEC: what it protects, who turns it on
DNSSEC stops a forged DNS answer from sending your visitors elsewhere. Who turns it on, in what order, and what can make your domain unreachable.
Read the guide →DMARC: who can send email as your domain?
Anyone can email your customers in your name. What DMARC asks mailbox providers to do, and how to reach reject without blocking your own mail.
Read the guide →Domain expiration: what to check
When a domain expires, your website and email stop the same day. What to check in your registrar account, and what to do if it's in your agency's name.
Read the guide →