Commands
- mx:
- Mail servers, IPs, reverse DNS, provider
- spf:
- SPF syntax, DNS lookup count, "all" rule
- dmarc:
- Policy, reports, external report destinations
- dkim:
- Keys and key size, with a selector: dkim:domain:selector
- bimi:
- Logo record and whether DMARC is strict enough
- mta-sts:
- TXT record, policy file over HTTPS, does it cover every MX?
- tlsrpt:
- Reports about TLS problems
- blacklist:
- An IP or a domain’s mail servers on 11 DNSBLs; no target: your IP
- a:
- IPv4 addresses with reverse DNS and network
- aaaa:
- IPv6 addresses with reverse DNS and network
- cname:
- Alias chain
- ns:
- Nameservers, authoritative?, same SOA serial? (alias dns:)
- soa:
- SOA values with sanity checks
- txt:
- Every TXT record
- srv:
- Service records, e.g. srv:_sip._tls.example.com
- caa:
- Which CAs may issue certificates
- ptr:
- Reverse DNS of an IP, forward-confirmed?
- whois:
- Registrar, expiry, DNSSEC
- asn:
- Network of an IP, or details of an AS number
- https:
- Certificate, expiry, TLS versions (host:port)