Skip to content
PixelPrivate
Log inFree trial
Menu
Attack Surface & ExposureEmail & Brand ProtectionData ExposureTrust & CompliancePolicy & AccessPlatform overviewCEOs of growing companiesCFOs and finance leadersManufacturingSaaSE-commerceHealthcare and clinicsProfessional servicesAgencies and MSPsCyber-insurance readinessReal casesScenariosFree toolsLearnPricingLog inStart 14-day free trial

Free tool

Domain security checker

Your domain is the root of your online identity: website, email and every login link depend on it. Domain security is about making sure the DNS records behind it are healthy, resilient and not quietly pointing at things you no longer control.

No credit card. Only scan domains you own or are authorized to assess. PixelPrivate performs passive, public checks only.

What this checks

  • A, AAAA, NS and MX resolution
  • Nameserver redundancy
  • CAA certificate-authority restrictions
  • DNSSEC delegation signer presence (best effort)
  • CNAMEs on common subdomains that point at names which do not resolve

How to use it

  1. Run the check for your root domain.
  2. Review DNS findings and decide which are relevant to you.
  3. Make changes at your DNS host or registrar, not at the website host.
  4. Rescan after DNS propagation (usually minutes, up to the record TTL).

Methodology and limitations

PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Registrar-level protections such as transfer lock cannot be seen from public DNS. Read the full security methodology.

Key terms

  • DNSSEC — DNSSEC (DNS Security Extensions) adds digital signatures to DNS answers so resolvers can detect forged or tampered responses..
  • CAA record — A CAA (Certification Authority Authorization) record is a DNS record that lists which certificate authorities are allowed to issue certificates for your domain..
  • Subdomain takeover — Subdomain takeover happens when a DNS record for one of your subdomains still points at an external service that you no longer use, and someone else can claim that service name and serve content as your subdomain..

Frequently asked questions

What is a dangling CNAME?

A CNAME that points to a service name that no longer exists. If the service allows anyone to claim that name, someone else could serve content on your subdomain. PixelPrivate flags the indicator but cannot confirm takeover is possible.

Should every domain use DNSSEC?

It is a good control when your DNS host and registrar both support it well. Misconfiguration can take a domain offline, so enable it carefully.

Keep this check running automatically

Create a free account to save results, track your score and get alerted when something changes.

Create free account

Related tools

Related guides