Best DNS audit guide

What's in a name? Specifically, a domain name? A lot more than you would think. You can find almost anything you want to know about an organization's online architecture, by running a few simple (and free) tests with their domain name. The information we'll be looking at is all public information. Most people just don't know where to look for it. The results of this audit can help you optimize your network configurations, DNS settings, and web performance... so follow along as we go through each test and take note of what you're missing!

#1 Name Servers

Let's start with the bare bones. What name servers is the domain's DNS information being hosted on? You can almost always tell the DNS hosting provider just by looking at the name servers. For example:ns11.constellix.net There are two ways you can find the name servers of a domain. If you prefer command line, you can run a dig ns (an NS lookup) to see the name servers authoritative for the domain. Or if you prefer a GUI, try the Sonar Lite Delegated Name Servers check.

What to look for:

No matter how large or small the organization is, it needs to be using more (at a bare minimum) two name servers. Name servers suffer outages all the time and can render any domain it's authoritative for as unavailable. Each name server that is authoritative for your domain drastically increases your chance of maintaining 100% uptime. Most DNS providers use IP Anycast networks, which are built on dozens (some cases, hundreds) of name servers across multiple points of presence. For example, there are roughly half a dozen name servers at each of the 16 points of presence in the Constellix network. That's over a hundred name servers that could be authoritative for a domain. If one name server is unreachable, the next closest name server would automatically take over and answer queries. A new trend has popped up, in light of recent attacks on major DNS providers, urging large organizations to use more than one DNS provider. Depending on the configuration you use, this could mean that two providers are authoritative for answering queries. Currently, this is the only proven way to maintain 100% availability during a provider outage.

#2 Network Issues

Next, you will want to test the domain for basic network issues. All of the following checks are available for free in the Sonar Lite extension in the Troubleshooting Wizard or the Sonar Lite web application.

WHOis Listing

Check the status of the domain and expiration date.

Port Connectivity

This step will help you make sure you don’t have any firewalls or network connectivity issues impacting your performance from a system outside your network.

HTTPS Status

HTTPS checks or SSL checkers can help you verify your SSL certificate if you just added SSL or HTTPS certificate to your domain. Google is now requiring all sites that collect sensitive information to have an SSL certificate, or they could incur a penalty.

#3 Size and Scope

When you're running a DNS audit, you will want to have a good idea of what the organization's web presence is like. Use Alexa or SimilarWeb to see how much web traffic the domain sees on a daily and monthly basis. This will give you a rough idea of what their query usage might be. It's important to note that this number can vary considerably if the domain is using low TTL's.You will also want to look at traffic sources. Organizations with a strong presence in multiple countries or regions will have different service requirements. For example, most organizations with a customer base in two or more regions will have different DNS rules for each area. This usually requires GeoDNS rules to segment traffic and deliver geographically unique answers.

#4 Record Types

There are four basic record types that every domain should have:

MX Record

MX or mail exchange records points to the mail server responsible for accepting mail for the domain.

A Record

If you have any subdomains, you will need to create A records that point that subdomain to a different end-point than your root domain.

AAAA Records

These are similar to A records, but they run over IPv6 rather than IPv4. AAAA records have become increasingly popular lately after IPv4 addresses ran out.

CNAME Record

If you use a CDN, you will need to have a CNAME record set up that points your incoming traffic to your CDN's hostname.

#5 Optimize!

If the domain you were auditing was missing any of the criteria we discussed already, you will want to fix them immediately. Failure to do so could lead to unavailability, performance issues, and even hurt your SEO. Did we miss anything? Let us know in the comments!