DNS
The DNS section analyzes the DNS configuration used for the monitored website's domain and allows you to view DNS records in detail.
In this section, WebPixie analyzes and presents the domain's DNS security, IP support, email validation records, and all DNS record types to the user.
This information can be used to verify the accuracy of DNS configuration and detect potential configuration errors.
DNS record changes are tracked and visible in the site's logs, but they do not generate incidents or alerts on their own.
How DNS Checks Work
WebPixie performs DNS checks daily, querying the domain's authoritative DNS server directly. Public resolvers (Google, Cloudflare, Quad9) are used only as a fallback if the authoritative server is unreachable, not as a separate cross-check.
General DNS Information
At the top of the DNS section, the basic DNS properties of the domain are displayed.
The following information is included in this section:
DNSSEC Status
Shows the domain's DNSSEC validation state. DNSSEC provides protection against attacks such as DNS spoofing by enabling verification of DNS queries.
The reported status is one of:
- Secure — DNSSEC is enabled and validates correctly
- Insecure — DNSSEC is not enabled for the domain
- Bogus — DNSSEC is enabled but validation fails (misconfiguration)
- Indeterminate — validation status could not be determined
IPv4 Support
Shows whether the domain is accessible via IPv4 addresses.
IPv6 Support
Shows whether the domain is accessible via IPv6.
Email Security Records
In the DNS section, DNS records related to email security are also analyzed.
SPF (Sender Policy Framework)
The SPF record specifies which servers are authorized to send email from a domain.
This record helps reduce attacks such as email spoofing.
WebPixie displays the following from the SPF record:
- Include records
- Policy values
DMARC
The DMARC record determines how email validation policies should be applied based on SPF and DKIM verification results.
The following fields of the DMARC record can be viewed in this section:
- DMARC version
- Policy
- Report addresses
- Percentage value
DMARC configuration is an important component for strengthening the email security of a domain.
BIMI
The BIMI (Brand Indicators for Message Identification) record allows a domain to display a verified brand logo in supporting email clients, alongside proper email authentication.
TLS-RPT
The TLS-RPT (SMTP TLS Reporting) record specifies where reports about TLS connection failures for inbound mail should be sent, helping identify delivery problems caused by TLS misconfigurations.
MTA-STS
The MTA-STS (Mail Transfer Agent Strict Transport Security) record helps enforce secure, encrypted delivery of email between mail servers.
WebPixie checks for the presence and format of the MTA-STS DNS record only. It does not fetch or analyze the actual MTA-STS policy file published on the domain.
Pointer Records (PTR)
Pointer Records show the reverse DNS records of IP addresses, covering both IPv4 and IPv6.
These records indicate which domain name corresponds to IP addresses and play an important role especially in email sending infrastructures.
DNS Records
The DNS Records section lists all DNS records for the domain by their types.
This section is designed for users who want to examine the DNS configuration in more detail.
Each record is shown together with its TTL (Time To Live) value, indicating how long the record is cached before it needs to be refreshed.
The supported DNS record types are as follows:
A Records
A records show the IPv4 addresses of the domain.
These records allow you to see which IP addresses the domain is directed to.
MX Records
MX records show the email servers of the domain.
These records determine which mail servers emails sent to the domain will be delivered to.
NS Records
NS records show the authoritative name servers of the domain.
These servers are the servers where DNS records are managed.
TXT Records
TXT records contain text-based DNS records for the domain.
These records are generally used for:
- Domain verification operations
- Email security configurations
- Third-party service verifications
SOA Record
The SOA (Start of Authority) record contains the administrative information of the DNS zone.
This record can contain the following information:
- Primary name server
- Zone administrator
- Serial number
- DNS refresh times
AAAA Records
AAAA records show the IPv6 addresses of the domain.
CNAME Records
CNAME records redirect a domain name to another domain name (canonical name), instead of directly listing an IP address.
SRV Records
SRV records define the hostname and port for specific services running on the domain (e.g., VoIP, chat services).
CAA Records
CAA records specify which Certificate Authorities are authorized to issue SSL certificates for the domain.
TLSA Records
TLSA records are used for DNS-Based Authentication of Named Entities (DANE), binding a TLS certificate to the domain name at the DNS level.
SSHFP Records
SSHFP records publish SSH public key fingerprints for the domain, allowing SSH clients to verify a server's identity via DNS.
HTTPS Records
HTTPS records provide connection parameters for HTTPS services, such as supported protocols and endpoint hints, without an extra round trip.
SVCB Records
SVCB records are the general-purpose counterpart to HTTPS records, used to advertise how clients can reach a service over other protocols.
SMIMEA Records
SMIMEA records associate an S/MIME certificate with a domain name for email encryption, similar in purpose to TLSA.
HIP Records
HIP records support the Host Identity Protocol, separating a host's identity from its network location.
NAPTR Records
NAPTR records are used for regex-based rewriting of domain names, commonly seen in VoIP (ENUM) and SIP configurations.
DS Records
DS records hold a hash of a child zone's DNSKEY, used to build the DNSSEC chain of trust from a parent zone.
DNSKEY Records
DNSKEY records hold the public keys used to validate DNSSEC-signed records for the domain.
CDNSKEY Records
CDNSKEY records propose a DNSKEY to be published by the parent zone, used during DNSSEC key rollovers.
CDS Records
CDS records propose a DS record to be published by the parent zone, used during DNSSEC key rollovers.
Domain
The Domain section is used to view domain information and the technical status of the domain for the monitored website.
SSL
The SSL section analyzes the TLS/SSL certificate configuration of the monitored website and provides detailed information about the certificate's validity, reliability, and technical specifications.