vulnbeacon_TOOLS
← All tools

DNS & email

DNS security

Use a validating DNS-over-HTTPS resolver to review published records. Reported DNSSEC status is a resolver verdict, not an independent zone audit.

How to use DNS securitySteps, privacy & next steps

Review CAA records and the validating resolver's DNSSEC assertion.

Run this check

  1. Enter the exact domain name.
  2. Confirm permission and the disclosed Cloudflare DNS lookup.
  3. Review CAA and DNSKEY observations with your DNS owner; verify the effective parent/zone configuration separately.

What you need

  • A domain name, without a URL path or mailbox.

Your input & privacy

The domain is sent to Cloudflare DNS over HTTPS only after consent. The tool does not change DNS records.

Read the result

Inspect the recorded DNS evidence and confirm intended certificate issuance and DNSSEC configuration with your provider.

Keep in mind

  • The resolver's AD flag is an assertion, not independent DNSSEC chain validation.
  • Missing AD does not prove DNSSEC is disabled. Inherited CAA and authoritative-server consistency are not assessed.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.