DNS Security Scanners
Weak DNS configuration enables phishing, email spoofing, and subdomain takeover attacks. DNS security scanners check your zones for missing SPF/DMARC records, misconfigured DNSSEC, open resolvers, and takeover-vulnerable records.
Important DNS Controls Scanners
DNS Zone Transfer Checker
DNS servers share zones using AXFR protocol. If it’s misconfigured, attackers can get all DNS information related to your domain. You can use S4E’s DNS vulnerability scanner to scan your DNS zone transfer.
DNS Rebinding Attack Scanner
This scanner detects the DNS Rebinding. It helps identify vulnerability arising from DNS responses containing private IP addresses and ensures network security.
DNSSEC Detection Scanner
This scanner detects the use of DNSSEC in digital assets. Domain Name System Security Extensions ensure authentic and verified domain responses, maintaining internet security.
DNS DMARC Scanner
This scanner detects the use of DNS DMARC in digital assets.
SPF Record Scanner
This scanner detects the use of SPF Record in digital assets. It helps in identifying whether an SPF TXT record is present, which is valuable for ensuring email security.
CAA Record Scanner
This scanner detects the use of CAA Record in digital assets.
ElasticBeanstalk Scanner
This scanner detects the ElasticBeanstalk Subdomain Takeover in digital assets. It helps identify potential security risks associated with subdomain takeover vulnerabilities, ensuring the protection of your online assets.
Predictable-TXID DNS Recursion Vulnerability Scanner
You can scan DNS server to predictable-TXID vulnerability by using this tool.
Dnsmasq File Disclosure Scanner
This scanner detects the use of Dnsmasq File Disclosure in digital assets.
DNS Nameserver ID (NSID) Scanner
You can scan DNS nameserver by using this tool.
DNS ANY Record Query
An ANY DNS query is used to get all DNS records available for a specific domain name. Let's check what DNS records are answered to ANY DNS query for your domain. Make an ANY DNS request with this tool.
SOA Record Service Scanner
This scanner detects the use of SOA Record Service in digital assets. It helps identify which domain provider a domain is using by analyzing the SOA records.
MX Record Detection Scanner
This scanner detects the use of MX Record in digital assets. It is valuable for identifying the mail exchange server configurations and ensuring proper email routing.
AAAA Record Lookup Tool
AAAA Record Lookup Tool
CVE-2007-1748 Scanner
Detects 'Buffer Overflow' vulnerability in RPC interface in the Domain Name System (DNS) Server Service affects v. Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2.
DNS MX Record Lookup
DNS MX Record Lookup
mDNS Enumeration
mDNS may disclose details about services running on a local network. When mDNS traffic is accessible from the public Internet, attackers can exploit it to map internal services. If exposure is suspected, perform enumeration with tools such as dig to collect additional information.
SRV Record Service - Detect
Detected services via SRV (Service) DNS records. SRV records defined the location of servers for specified services.
TLSA Record - DANE Detection
A TLSA record was detected. TLSA records are used for DANE (DNS-based Authentication of Named Entities) to bind TLS certificates to domain names.
DNS TXT Service Scanner
This scanner detects the use of DNS TXT Service in digital assets. It helps identify which services companies are using by analyzing their TXT records for specific service verification entries.
BIMI Record Scanner
This scanner detects the use of BIMI Record in digital assets. It ensures that BIMI records are identified, enhancing brand recognition and email marketing efforts.
PTZOptics Device via mDNS - Detect
Detects PTZOptics camera devices exposed via mDNS (Multicast DNS) on port 5353. PTZOptics cameras broadcast mDNS service advertisements including SSH, SFTP, and NDI streaming services. These devices are commonly used for video conferencing and broadcast production.
FBI Seized Nameserver Scanner
This scanner detects the use of FBI Seized Nameserver in digital assets.
Wildcard DNS Configuration - Detection
A wildcard DNS configuration was detected. Wildcard DNS records can resolve all subdomains to the same IP address, which may indicate a catch-all configuration.
DNS SaaS Service Detection Scanner
This scanner detects the use of DNS SaaS Service in digital assets. It identifies specific DNS CNAME configurations often used across various cloud and service platforms to ensure accurate detection of their implementation.
DNS Servfail Host Finder Scanner
This scanner detects the DNS Servfail in digital assets.
AAAA Record - IPv6 Detection
An AAAA record was detected. AAAA records are used to map domain names to IPv6 addresses.
DKIM Record - Detection
A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.
CNAME Detect Dangling Scanner
This scanner detects the use of Dangling CNAME in digital assets. It identifies potential vulnerabilities arising from unremoved records, ensuring proper configuration of DNS records for enhanced security.
Public DNS Resolving to Private IP Addresses
Detected when a public domain's DNS A records resolved to private or reserved IP addresses, potentially revealing internal network topology to external parties.
DNS A Record Lookup
Any system or anyone who wants to access your domain has to resolve your A records. These records point to IPv4 addresses. You can make an online DNS A record lookup, and check IPv4 address of your domain.
PTR Detected Scanner
This scanner detects the use of DNS PTR records in digital assets. It identifies DNS PTR records that map IP addresses to domain names for reverse DNS lookup. This is valuable for assessing information exposure in network setups.
DNS NS Record Lookup
DNS NS Record Lookup Tool
DNS CNAME Record Lookup
DNS CNAME Record Lookup Tool
DNS TXT Record Lookup
TXT records are used to keep text values related to your domain name. This type of record usually used for, proof for ownership of domain (google, yandex verification), Sender Policy Framework (SPF) records or DKIM. Check your TXT records with TXT record lookup tool.
NS Record Detection Scanner
This scanner detects the use of NS Record in digital assets.
Detect DNS over HTTPS
Even if you are visiting a site using HTTPS, your DNS query is sent over an unencrypted connection. That means that even if you are browsing https://cloudflare.com, anyone listening to packets on the network knows you are attempting to visit cloudflare.com.
SPF record DNS lookup limit
SPF (Sender Policy Framework) records that exceed the 10 DNS lookup limit was detected. SPF records with more than 10 DNS-based mechanisms may cause SPF authentication failures, leading to potential email delivery issues and spoofing risks.
Run all DNS Controls checks at once.
S4E covers 38+ scanners in this category with continuous monitoring and full remediation guidance.
Start Free Scan →