Domain Security Analysis
A comprehensive security scanner for every custom domain registered in your Microsoft Entra ID tenant. All checks use publicly available data sources — DNS records, RDAP registration data, and Microsoft's public endpoints — requiring no additional permissions beyond reading the domain list.
Security Score (0–100)
Each domain receives a security score based on its email authentication configuration. Points are deducted for missing or weak SPF, DKIM, DMARC, and MX configurations. Domains are classified as Low, Medium, High, or Critical risk.
Email Authentication Analysis
- SPF — Validates the Sender Policy Framework record, checks enforcement level (+all, ~all, -all, ?all), counts DNS lookups against the RFC 7208 limit of 10, and recursively analyzes the full include chain to detect broken references.
- DKIM — Probes multiple common DKIM selectors to verify DomainKeys Identified Mail signing is configured.
- DMARC — Analyzes the DMARC policy (none, quarantine, reject), subdomain policy, percentage coverage, and reporting configuration.
- MX — Verifies mail exchange records, identifies the mail provider, detects split MX configurations (critical risk), and confirms Microsoft 365 routing.
Advanced DNS Security
Checks for BIMI (brand logo in email), MTA-STS (enforced TLS), TLS-RPT (TLS failure reports), CAA (certificate authority restrictions), DANE (DNS-based certificate authentication), and DNSSEC (DNS record signing).
Third-Party Service Detection
Discovers 70+ external services configured on your domains through SPF includes, TXT verification records, DKIM selectors, MX routing, and CNAME entries — including email providers, marketing platforms, CRMs, security gateways, CDNs, and hosting services.
DNS Probe
Full inventory of root-level DNS records (TXT, MX, NS, A, AAAA, CNAME, SOA, CAA, SRV) with TTL values. Discovers hosts by probing common subdomain prefixes (mail, autodiscover, vpn, api, etc.). Detects DNS hosting provider from NS records.
WHOIS / RDAP Lookup
Queries the RDAP (Registration Data Access Protocol) service for domain registration details — registrar, registrant organization, creation date, and expiry date. Domains expiring within 30 days are flagged with a warning.
Dangling DNS Detection
Checks CNAME records against 18 known subdomain-takeover-vulnerable cloud services (Azure, AWS, GitHub Pages, Heroku, etc.) and verifies whether the target still resolves. Dangling records are flagged as subdomain takeover risks.
Parked / Unused Domain Detection
Identifies domains with zero users that may be parked or unused, and recommends adding reject-all SPF and DMARC records to prevent email spoofing abuse.
Historical Trends
Security scores for each domain are tracked over time in CosmosDB. Domain names are hashed for privacy in the stored data. View trend charts showing how your domain security posture evolves.