// Audit a domain's DNS records — MX, SPF, DKIM, DMARC, CAA, A/AAAA — for correctness and best-practice. Use when onboarding a new domain or when an email-deliverability or SSL issue surfaces.
| name | dns-audit |
| description | Audit a domain's DNS records — MX, SPF, DKIM, DMARC, CAA, A/AAAA — for correctness and best-practice. Use when onboarding a new domain or when an email-deliverability or SSL issue surfaces. |
Comprehensive DNS record audit, producing a structured report + an action list.
| Record | Check | Best practice |
|---|---|---|
| A / AAAA | Resolves? TTL sensible? | TTL 300-3600 for active, 86400 for stable |
| MX | Matches expected provider? Priority correct? | One primary, optional secondary |
| SPF | Present? Provider includes correct? Ends with ~all or -all? | -all preferred for production |
| DKIM | Selector(s) for provider? Key length 2048? | 2048-bit RSA |
| DMARC | Present? p=quarantine or p=reject? rua/ruf set? | p=quarantine; sp=quarantine; rua=mailto:... |
| CAA | Limits cert issuers? | At least lets-encrypt + the active provider |
| NS | Matches expected registrar? | All NS records match |
wiki/properties/websites/<domain>/audit-<date>.md with:
---
kind: dns-audit
domain: <domain>
audited_on: <date>
overall: pass | warn | fail
---
## Summary
[2-3 lines]
## Findings
[Per-record check result; flag warnings + failures]
## Actions
[Concrete fixes, ranked by urgency]
p=reject on DMARC for domains that haven't been monitored at p=none first