| name | dns-audit |
| description | Audit a domain's DNS records — MX, SPF, DKIM, DMARC, CAA, A/AAAA — for correctness and best-practice. Use when onboarding a new domain or when an email-deliverability or SSL issue surfaces. |
DNS audit
Comprehensive DNS record audit, producing a structured report + an action list.
Inputs
- Domain name
- Expected email provider (Google Workspace, Microsoft 365, SMTP2Go, etc.)
- Whether the domain should accept email at all
Checks
| Record | Check | Best practice |
|---|
| A / AAAA | Resolves? TTL sensible? | TTL 300-3600 for active, 86400 for stable |
| MX | Matches expected provider? Priority correct? | One primary, optional secondary |
| SPF | Present? Provider includes correct? Ends with ~all or -all? | -all preferred for production |
| DKIM | Selector(s) for provider? Key length 2048? | 2048-bit RSA |
| DMARC | Present? p=quarantine or p=reject? rua/ruf set? | p=quarantine; sp=quarantine; rua=mailto:... |
| CAA | Limits cert issuers? | At least lets-encrypt + the active provider |
| NS | Matches expected registrar? | All NS records match |
Output
wiki/properties/websites/<domain>/audit-<date>.md with:
---
kind: dns-audit
domain: <domain>
audited_on: <date>
overall: pass | warn | fail
---
[2-3 lines]
[Per-record check result; flag warnings + failures]
[Concrete fixes, ranked by urgency]
Anti-patterns
- Reporting "all good" without checking each record
- Recommending
p=reject on DMARC for domains that haven't been monitored at p=none first
- Removing SPF without verifying current email senders
