🛡️ RFC Compliance & Architecture Audit

DNS Health & Scorecard Audit

Test domain DNS configuration against IETF RFC standards, nameserver redundancy, open recursive resolvers, and SOA integrity.

Popular Audits: • •

What Is a DNS Health Audit?

A DNS health audit is an automated evaluation of a domain's DNS zone configuration against IETF RFC standards. It identifies nameserver redundancy, glue record validity, SOA serial synchronization, and security vulnerabilities that could cause website downtime or email delivery failure.

1. Nameserver Redundancy (RFC 2182)

Validates that the domain has at least two independent authoritative nameservers on different geographic IP subnets.

2. SOA Serial & Refresh Timers

Ensures primary and secondary nameservers are synchronized with valid zone transfer retry and expiration timers.

3. Open Recursion & Amplification

Confirms authoritative servers do not respond to open recursive queries that could be abused in DDoS reflection attacks.

Frequently Asked Questions

RFC 2182 requires at least two authoritative nameservers placed on distinct networks and subnets so that a failure in one data center or network route does not make your entire domain inaccessible.

The standard recommended format for an SOA serial number is YYYYMMDDnn (Year, Month, Day, Revision). Every time a zone is updated, incrementing the serial prompts secondary nameservers to fetch the updated zone.

If secondary nameservers fail to sync with the primary nameserver, users and web resolvers will receive inconsistent or outdated IP addresses depending on which nameserver answers their query.

Review the flagged checks on the scorecard: add secondary nameservers, configure SPF/DKIM records, ensure SOA refresh timers are between 1200 and 86400 seconds, and disable open recursion on private nameservers.

DNS & Email Security Suite