dns-audit

name	dns-audit
description	Audit a domain's DNS records — MX, SPF, DKIM, DMARC, CAA, A/AAAA — for correctness and best-practice. Use when onboarding a new domain or when an email-deliverability or SSL issue surfaces.

DNS audit

Comprehensive DNS record audit, producing a structured report + an action list.

Inputs

• Domain name
• Expected email provider (Google Workspace, Microsoft 365, SMTP2Go, etc.)
• Whether the domain should accept email at all

Checks

Record	Check	Best practice
A / AAAA	Resolves? TTL sensible?	TTL 300-3600 for active, 86400 for stable
MX	Matches expected provider? Priority correct?	One primary, optional secondary
SPF	Present? Provider includes correct? Ends with ~all or -all?	-all preferred for production
DKIM	Selector(s) for provider? Key length 2048?	2048-bit RSA
DMARC	Present? p=quarantine or p=reject? rua/ruf set?	p=quarantine; sp=quarantine; rua=mailto:...
CAA	Limits cert issuers?	At least lets-encrypt + the active provider
NS	Matches expected registrar?	All NS records match

Output

wiki/properties/websites/<domain>/audit-<date>.md with:

---
kind: dns-audit
domain: <domain>
audited_on: <date>
overall: pass | warn | fail
---

## Summary
[2-3 lines]

## Findings
[Per-record check result; flag warnings + failures]

## Actions
[Concrete fixes, ranked by urgency]

Anti-patterns

• Reporting "all good" without checking each record
• Recommending p=reject on DMARC for domains that haven't been monitored at p=none first
• Removing SPF without verifying current email senders