DNS Security

What this check looks for

StackShield inspects your domain's DNS configuration against established best practice, drawing on the guidance in NIST SP 800-81. It checks for DNSSEC signing, a CAA record controlling which authorities may issue certificates for your domain, and the general hygiene of your records.

Why it matters

DNS is the layer everything else trusts. If an attacker can tamper with your DNS answers, they can redirect your traffic, intercept your mail, or obtain a valid certificate for your domain, and the browser padlock will still appear because the certificate is genuinely issued.

DNSSEC signs your records so resolvers can detect tampering. A CAA record restricts certificate issuance to the authorities you nominate, closing the path where an attacker convinces a different CA to issue a certificate for your domain. Neither is on by default, and their absence is a gap most teams never look at because DNS feels like settled infrastructure.

What a failed check means

A failed check means your domain is missing one or more of these protections: no DNSSEC, no CAA record, or record configuration that departs from best practice. None is an active breach, but each leaves a class of DNS-layer attack undetected or unrestricted.

The fix is enabling DNSSEC at your registrar, adding a CAA record naming your certificate authority, and reviewing records against the checklist in the DNS security guide.

See the step-by-step remediation: how to fix this.