Learn how InfraNest reviews your domain's DNS and email settings and flags anything that could let email get spoofed or leave your site less secure. This is for anyone who manages a domain and wants a plain-language health check without needing to know DNS jargon.
Overview
- Every zone has a built-in Security Advisor that checks the DNS records that matter most for email delivery and security.
- It reads your domain's live DNS, so the results are accurate no matter who manages the records.
- Each check comes with a clear status and a plain explanation of why it matters, so you don't need to be a DNS expert to understand what's going on.
Run the advisor
- Open a zone from the DNS page.
- Look at the Security Advisor. Each check shows a clear status and a plain explanation of why it matters. The zone's overall security status also shows in the zone list, so you can scan your whole portfolio at a glance.
What it checks
- SPF — the sender policy that stops your domain being used to spoof email.
- DMARC — tells receiving mail servers what to do with unauthenticated mail.
- DKIM — checks for DKIM email signing.
- MX — whether mail is actually set up for the domain.
- DNSSEC — whether the zone is cryptographically signed against tampering.
- CAA — which certificate authorities are allowed to issue certificates for the domain.
For zones hosted at Cloudflare, it also checks settings that aren't records at all — SSL mode, minimum TLS version, the HTTPS redirect, HSTS and development mode. The most common issue here is an SSL mode set to Flexible, which means visitors see a padlock while the traffic behind it is unencrypted.
NoteThe CAA check works together with your SSL certificates (it controls who can issue them), and the SPF/DMARC/DKIM/MX checks protect your email deliverability.
Was this article helpful?