Pricing

Pay per usage

Try for free

Go to Apify Store

DNSSEC Validator

Try for free

Validate a domain's DNSSEC chain of trust: DS delegation, DNSKEY KSK/ZSK, RRSIG coverage, and AD bit support. Returns score, grade, and recommendations.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Sanskar Jaiswal

Actor stats

Bookmarked

Total users

Monthly active users

25 days ago

Last modified

Dockerfile

FROM apify/actor-node:22

COPY package*.json ./
RUN npm --quiet set progress=false \
    && npm install --omit=dev --omit=optional

COPY . ./

CMD npm start --silent

package.json

{
  "name": "dnssec-validator",
  "version": "0.1.0",
  "description": "Apify Actor that validates a domain's DNSSEC chain of trust: DS, DNSKEY, RRSIG coverage, and AD bit.",
  "type": "module",
  "private": true,
  "main": "src/main.js",
  "scripts": {
    "start": "node src/main.js",
    "test": "node --test test/*.test.js",
    "lint": "node --check src/main.js"
  },
  "dependencies": {
    "apify": "^3.4.5"
  },
  "devDependencies": {}
}

.actor/actor.json

{
  "actorSpecification": 1,
  "name": "dnssec-validator",
  "title": "DNSSEC Validator",
  "description": "Validate a domain's DNSSEC chain: DS delegation at parent zone, DNSKEY presence, RRSIG coverage on common record types, and trust anchor reachability. Returns a readiness score, grade, and recommendations.",
  "version": "0.1",
  "buildTag": "latest",
  "meta": {
    "templateId": "js-start"
  },
  "input": "./input_schema.json",
  "output": "./output_schema.json",
  "storages": {
    "dataset": "./dataset_schema.json"
  },
  "dockerfile": "./Dockerfile",
  "defaultRunOptions": {
    "build": "latest",
    "timeoutSecs": 60,
    "memoryMbytes": 512
  }
}

.actor/dataset_schema.json

{
  "actorSpecification": 1,
  "fields": {
    "type": "object",
    "properties": {
      "inputUrl": { "type": "string", "description": "The URL or domain provided as input" },
      "domain": { "type": "string", "description": "Extracted domain name used for DNS lookups" },
      "checkedAt": { "type": "string", "format": "date-time", "description": "ISO timestamp" },
      "score": { "type": "integer", "description": "DNSSEC readiness score from 0 to 100" },
      "grade": { "type": "string", "description": "Letter grade from A to F" },
      "issues": { "type": "array", "description": "Human-readable issues found" },
      "recommendations": { "type": "array", "description": "Recommended fixes" },
      "error": { "type": ["string", "null"], "description": "Error message, if any" }
    }
  },
  "views": {
    "overview": {
      "title": "Overview",
      "transformation": {
        "fields": ["domain", "checkedAt", "score", "grade", "issues", "recommendations"]
      },
      "display": {
        "component": "table",
        "properties": {
          "domain": { "label": "Domain", "format": "text" },
          "checkedAt": { "label": "Checked", "format": "date" },
          "score": { "label": "Score", "format": "number" },
          "grade": { "label": "Grade", "format": "text" },
          "issues": { "label": "Issues", "format": "array" },
          "recommendations": { "label": "Recommendations", "format": "array" }
        }
      }
    }
  }
}

.actor/input_schema.json

{
  "title": "DNSSEC Validator",
  "type": "object",
  "schemaVersion": 1,
  "description": "Validate one public domain's DNSSEC chain of trust. Checks DS records at the parent zone, DNSKEY presence, RRSIG coverage on common record types, and returns a readiness score with recommendations.",
  "properties": {
    "startUrl": {
      "title": "Domain or website URL",
      "type": "string",
      "description": "Public domain or URL to validate. The actor extracts the hostname and checks DNS DS, DNSKEY, and RRSIG records for DNSSEC chain-of-trust validation. HTTP and HTTPS only. Private IP ranges are blocked.",
      "editor": "textfield",
      "prefill": "https://example.com"
    },
    "recordTypes": {
      "title": "Record types to check for RRSIG coverage",
      "type": "array",
      "description": "Optional list of DNS record types to check for RRSIG coverage. If empty, the actor checks A, AAAA, MX, TXT, and DNSKEY. Each type is queried at the domain apex.",
      "editor": "stringList",
      "items": { "type": "string" },
      "prefill": []
    },
    "timeoutSeconds": {
      "title": "DNS query timeout (seconds)",
      "type": "integer",
      "description": "Timeout for each DNS lookup.",
      "minimum": 3,
      "maximum": 30,
      "default": 10,
      "unit": "seconds",
      "editor": "number"
    }
  },
  "required": ["startUrl"]
}

.actor/output_schema.json

{
  "actorOutputSchemaVersion": 1,
  "title": "Output schema of DNSSEC Validator",
  "description": "Validation results are stored in the default dataset.",
  "properties": {
    "results": {
      "type": "string",
      "title": "Validation results",
      "template": "{{links.apiDefaultDatasetUrl}}/items"
    }
  }
}

src/main.js

1import { Actor } from 'apify';
2import dns from 'node:dns/promises';
3import net from 'node:net';
4import { fileURLToPath } from 'node:url';
5
6// ponytail: Node's dns module doesn't support DS/DNSKEY/RRSIG record types.
7// All DNSSEC-specific lookups go through Cloudflare DoH JSON API (public, no auth).
8// Only dns.lookup is used for SSRF validation on the input URL.
9
10const DEFAULT_RECORD_TYPES = ['A', 'AAAA', 'MX', 'TXT', 'DNSKEY'];
11const DEFAULT_TIMEOUT_SECONDS = 10;
12const DEFAULT_DOH_URL = 'https://cloudflare-dns.com/dns-query';
13
14// DNS record type numbers for DoH JSON API
15const TYPE_A = 1;
16const TYPE_AAAA = 28;
17const TYPE_MX = 15;
18const TYPE_TXT = 16;
19const TYPE_DNSKEY = 48;
20const TYPE_DS = 43;
21const TYPE_RRSIG = 46;
22
23const TYPE_NAME_TO_NUMBER = { A: 1, AAAA: 28, MX: 15, TXT: 16, DNSKEY: 48, DS: 43, RRSIG: 46 };
24const TYPE_NUMBER_TO_NAME = { 1: 'A', 28: 'AAAA', 15: 'MX', 16: 'TXT', 48: 'DNSKEY', 43: 'DS', 46: 'RRSIG' };
25
26function isPrivateIPv4(ip) {
27  const parts = ip.split('.').map(Number);
28  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false;
29  const [a, b] = parts;
30  return a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || a === 127 || a === 0 || (a === 169 && b === 254);
31}
32
33function isPrivateIPv6(ip) {
34  const normalized = ip.toLowerCase();
35  return normalized === '::1' || normalized.startsWith('fc') || normalized.startsWith('fd') || normalized.startsWith('fe80:');
36}
37
38export async function normalizeAndValidateUrl(rawUrl) {
39  if (!rawUrl || typeof rawUrl !== 'string') throw new Error('startUrl is required');
40  if (/^[a-z][a-z0-9+.-]*:/i.test(rawUrl) && !/^https?:\/\//i.test(rawUrl)) throw new Error('Only HTTP and HTTPS URLs are supported');
41  const withScheme = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
42  const url = new URL(withScheme);
43  if (!['http:', 'https:'].includes(url.protocol)) throw new Error('Only HTTP and HTTPS URLs are supported');
44  if (!url.hostname || url.username || url.password) throw new Error('URL must be public and must not include credentials');
45
46  const literalType = net.isIP(url.hostname);
47  if (literalType === 4 && isPrivateIPv4(url.hostname)) throw new Error('Private IPv4 targets are blocked');
48  if (literalType === 6 && isPrivateIPv6(url.hostname)) throw new Error('Private IPv6 targets are blocked');
49
50  const records = literalType ? [{ address: url.hostname, family: literalType }] : await dns.lookup(url.hostname, { all: true });
51  for (const record of records) {
52    if (record.family === 4 && isPrivateIPv4(record.address)) throw new Error('DNS resolves to a private IPv4 address; blocked for SSRF safety');
53    if (record.family === 6 && isPrivateIPv6(record.address)) throw new Error('DNS resolves to a private IPv6 address; blocked for SSRF safety');
54  }
55  return url;
56}
57
58function clampInteger(value, fallback, min, max) {
59  const parsed = Number(value);
60  if (!Number.isFinite(parsed)) return fallback;
61  return Math.min(Math.max(Math.trunc(parsed), min), max);
62}
63
64function getParentDomain(domain) {
65  // ponytail: works for simple TLDs; does not handle public-suffix-list edge cases like co.uk.
66  // For DS lookups the query targets the child domain directly, so parent derivation is informational.
67  const parts = domain.split('.');
68  if (parts.length <= 2) return domain;
69  return parts.slice(1).join('.');
70}
71
72async function dohQuery(name, type, timeoutSeconds, dohUrl) {
73  const controller = new AbortController();
74  const timer = setTimeout(() => controller.abort(), timeoutSeconds * 1000);
75  try {
76    const url = `${dohUrl}?name=${encodeURIComponent(name)}&type=${type}`;
77    const res = await fetch(url, {
78      headers: { accept: 'application/dns-json' },
79      signal: controller.signal,
80    });
81    if (!res.ok) return { Status: res.status, Answer: [], AD: false };
82    return await res.json();
83  } catch {
84    return { Status: 99, Answer: [], AD: false };
85  } finally {
86    clearTimeout(timer);
87  }
88}
89
90export function parseDsData(dohAnswers) {
91  // DoH DS answers: { name, type: 43, TTL, data: "12345 13 2 ABCDEF..." }
92  return dohAnswers.map((a) => {
93    const parts = (a.data || '').split(/\s+/);
94    return {
95      keyTag: parts[0] ? parseInt(parts[0], 10) : null,
96      algorithm: parts[1] ? parseInt(parts[1], 10) : null,
97      digestType: parts[2] ? parseInt(parts[2], 10) : null,
98      digest: parts.slice(3).join(' ') || null,
99    };
100  }).filter((r) => r.keyTag !== null);
101}
102
103export function parseDnskeyData(dohAnswers) {
104  // DoH DNSKEY answers: { name, type: 48, TTL, data: "257 3 13 MIIBIjAN..." }
105  return dohAnswers.map((a) => {
106    const parts = (a.data || '').split(/\s+/);
107    const flags = parts[0] ? parseInt(parts[0], 10) : null;
108    const protocol = parts[1] ? parseInt(parts[1], 10) : null;
109    const algorithm = parts[2] ? parseInt(parts[2], 10) : null;
110    const publicKey = parts.slice(3).join(' ') || null;
111    return {
112      flags,
113      algorithm,
114      protocol,
115      publicKey: publicKey ? `${publicKey.slice(0, 16)}...` : null,
116    };
117  }).filter((r) => r.flags !== null);
118}
119
120// DNSKEY flag bits (RFC 4034): bit 7 = zone key (0x100=256), bit 8 = revoke (0x80=128), bit 15 = SEP/KSK (0x01=1)
121export function classifyDnskeyFlags(flags) {
122  if (flags === undefined || flags === null) return { zoneKey: false, secureEntryPoint: false, revoked: false };
123  return {
124    zoneKey: Boolean(flags & 0x100), // bit 7
125    secureEntryPoint: Boolean(flags & 0x001), // bit 15 (KSK)
126    revoked: Boolean(flags & 0x080), // bit 8 (revoked)
127  };
128}
129
130export async function auditDnssec(input) {
131  const timeoutSeconds = clampInteger(input.timeoutSeconds, DEFAULT_TIMEOUT_SECONDS, 3, 30);
132  const recordTypes = input.recordTypes?.length ? input.recordTypes : DEFAULT_RECORD_TYPES;
133  const dohUrl = DEFAULT_DOH_URL;
134
135  let domain;
136  try {
137    const target = await normalizeAndValidateUrl(input.startUrl);
138    domain = target.hostname;
139  } catch (err) {
140    return {
141      inputUrl: input.startUrl, domain: null, checkedAt: new Date().toISOString(),
142      dsAtParent: { found: false, records: [], issues: [] },
143      dnskey: { found: false, records: [], keySigningKeys: [], zoneSigningKeys: [], issues: [] },
144      rrsigCoverage: { checked: [], signed: [], unsigned: [], issues: [] },
145      adBitCheck: { supported: null, issues: [] },
146      score: 0, grade: 'F', issues: [err.message], recommendations: [], error: err.message,
147    };
148  }
149
150  const parentDomain = getParentDomain(domain);
151
152  // 1. DS records at the zone (queried on the domain itself; DS is in the parent zone)
153  const dsResponse = await dohQuery(domain, 'DS', timeoutSeconds, dohUrl);
154  const dsAnswers = (dsResponse.Answer || []).filter((a) => a.type === TYPE_DS);
155  const dsParsed = parseDsData(dsAnswers);
156
157  // 2. DNSKEY at the zone
158  const dnskeyResponse = await dohQuery(domain, 'DNSKEY', timeoutSeconds, dohUrl);
159  const dnskeyAnswers = (dnskeyResponse.Answer || []).filter((a) => a.type === TYPE_DNSKEY);
160  const dnskeyParsed = parseDnskeyData(dnskeyAnswers);
161  const kskKeys = dnskeyParsed.filter((k) => classifyDnskeyFlags(k.flags).secureEntryPoint);
162  const zskKeys = dnskeyParsed.filter((k) => classifyDnskeyFlags(k.flags).zoneKey && !classifyDnskeyFlags(k.flags).secureEntryPoint);
163
164  // 3. RRSIG coverage for requested record types
165  const rrsigChecks = await Promise.all(
166    recordTypes.map(async (type) => {
167      const response = await dohQuery(domain, type, timeoutSeconds, dohUrl);
168      const answers = response.Answer || [];
169      const typeNum = TYPE_NAME_TO_NUMBER[type.toUpperCase()];
170      const hasAnswer = answers.some((a) => a.type === typeNum);
171      const hasRrsig = answers.some((a) => a.type === TYPE_RRSIG);
172      return { type, hasAnswer, hasRrsig, signed: hasRrsig };
173    }),
174  );
175  const signedTypes = rrsigChecks.filter((c) => c.signed).map((c) => c.type);
176  const unsignedTypes = rrsigChecks.filter((c) => c.hasAnswer && !c.signed).map((c) => c.type);
177
178  // 4. AD bit check
179  const adSupported = Boolean(dnskeyResponse.AD);
180
181  // Scoring
182  let value = 100;
183  const issues = [];
184  const recommendations = [];
185
186  if (!dsParsed.length) {
187    value -= 35;
188    issues.push('No DS records found at parent zone — DNSSEC chain of trust is not anchored');
189    recommendations.push('Publish DS records at the parent zone (registrar) to establish a chain of trust from the root to your domain.');
190  } else {
191    issues.push(`${dsParsed.length} DS record(s) found at parent zone`);
192  }
193
194  if (!dnskeyParsed.length) {
195    value -= 35;
196    issues.push('No DNSKEY records found at the zone');
197    recommendations.push('Generate DNSSEC key pairs (KSK and ZSK) and publish DNSKEY records at the zone apex.');
198  } else {
199    if (kskKeys.length === 0) {
200      value -= 15;
201      issues.push('No KSK (key-signing key) found — DS at parent cannot be verified against zone DNSKEY');
202      recommendations.push('Create a KSK (flags 257) and use it to sign the DNSKEY RRset so DS records at the parent can be verified.');
203    }
204    if (zskKeys.length === 0) {
205      value -= 10;
206      issues.push('No ZSK (zone-signing key) found — record RRsets cannot be signed');
207      recommendations.push('Create a ZSK (flags 256) to sign non-DNSKEY record RRsets (A, AAAA, MX, TXT, etc.).');
208    }
209  }
210
211  if (unsignedTypes.length > 0) {
212    value -= 15 * Math.min(unsignedTypes.length, 3); // cap at -45
213    issues.push(`RRSIG coverage missing for: ${unsignedTypes.join(', ')}`);
214    recommendations.push(`Sign ${unsignedTypes.join(', ')} RRsets with RRSIG records using the zone's ZSK.`);
215  }
216
217  if (!adSupported) {
218    value -= 10;
219    issues.push('Recursive resolver did not return AD bit — DNSSEC validation may not be enforced upstream');
220    recommendations.push('Ensure upstream resolvers validate DNSSEC and set the AD bit on validated responses.');
221  }
222
223  if (dsParsed.length > 0 && dnskeyParsed.length > 0 && kskKeys.length > 0 && zskKeys.length > 0 && unsignedTypes.length === 0) {
224    issues.push('DNSSEC chain of trust appears complete: DS at parent, DNSKEY with KSK+ZSK, RRSIG on checked types');
225  }
226
227  const bounded = Math.max(0, Math.min(100, value));
228  const grade = bounded >= 90 ? 'A' : bounded >= 75 ? 'B' : bounded >= 60 ? 'C' : bounded >= 45 ? 'D' : 'F';
229
230  return {
231    inputUrl: input.startUrl, domain, checkedAt: new Date().toISOString(),
232    dsAtParent: {
233      found: dsParsed.length > 0,
234      parentDomain,
235      recordCount: dsParsed.length,
236      records: dsParsed,
237      issues: dsParsed.length === 0 ? ['No DS records found at parent zone'] : [],
238    },
239    dnskey: {
240      found: dnskeyParsed.length > 0,
241      keyCount: dnskeyParsed.length,
242      keySigningKeys: kskKeys,
243      zoneSigningKeys: zskKeys,
244      records: dnskeyParsed,
245      issues: [
246        ...(kskKeys.length === 0 ? ['No KSK found'] : []),
247        ...(zskKeys.length === 0 ? ['No ZSK found'] : []),
248      ],
249    },
250    rrsigCoverage: {
251      checked: recordTypes,
252      signed: signedTypes,
253      unsigned: unsignedTypes,
254      details: rrsigChecks.map((c) => ({ type: c.type, hasAnswer: c.hasAnswer, signed: c.signed })),
255      issues: unsignedTypes.length > 0 ? [`Missing RRSIG for: ${unsignedTypes.join(', ')}`] : [],
256    },
257    adBitCheck: {
258      supported: adSupported,
259      issues: adSupported ? [] : ['Recursive resolver did not return AD bit'],
260    },
261    score: bounded, grade, issues, recommendations, error: null,
262  };
263}
264
265const isExecutedDirectly = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
266
267if (process.env.NODE_ENV !== 'test' && isExecutedDirectly) {
268  await Actor.init();
269  try {
270    const result = await auditDnssec(await Actor.getInput() || {});
271    await Actor.pushData(result);
272    await Actor.setValue('OUTPUT', result);
273    Actor.log.info('DNSSEC validation complete', { domain: result.domain, score: result.score, grade: result.grade });
274  } finally {
275    await Actor.exit();
276  }
277}

test/main.test.js

1import test from 'node:test';
2import assert from 'node:assert/strict';
3import { normalizeAndValidateUrl, parseDsData, parseDnskeyData, classifyDnskeyFlags, auditDnssec } from '../src/main.js';
4
5test('normalizeAndValidateUrl blocks private IPv4 literal', async () => {
6  await assert.rejects(() => normalizeAndValidateUrl('http://127.0.0.1'), /Private IPv4/);
7});
8
9test('normalizeAndValidateUrl rejects URL credentials', async () => {
10  await assert.rejects(() => normalizeAndValidateUrl('https://user:pass@example.com'), /credentials/);
11});
12
13test('normalizeAndValidateUrl extracts domain from URL', async () => {
14  const url = await normalizeAndValidateUrl('https://example.com');
15  assert.equal(url.hostname, 'example.com');
16});
17
18test('parseDsData parses DS record fields from DoH answer', () => {
19  // DoH JSON answer format: { name, type: 43, TTL, data: "12345 13 2 ABCDEF0123456789" }
20  const ds = parseDsData([{ name: 'example.com', type: 43, TTL: 300, data: '12345 13 2 ABCDEF0123456789' }]);
21  assert.equal(ds.length, 1);
22  assert.equal(ds[0].keyTag, 12345);
23  assert.equal(ds[0].algorithm, 13);
24  assert.equal(ds[0].digestType, 2);
25  assert.equal(ds[0].digest, 'ABCDEF0123456789');
26});
27
28test('parseDsData skips invalid DS records', () => {
29  const ds = parseDsData([{ name: 'example.com', type: 43, data: '' }]);
30  assert.deepEqual(ds, []);
31  assert.deepEqual(parseDsData([]), []);
32});
33
34test('parseDnskeyData parses DNSKEY record fields from DoH answer', () => {
35  // DoH JSON answer format: { name, type: 48, TTL, data: "257 3 13 MIIBIjANBgkqh" }
36  const keys = parseDnskeyData([{ name: 'example.com', type: 48, TTL: 300, data: '257 3 13 MIIBIjANBgkqh' }]);
37  assert.equal(keys.length, 1);
38  assert.equal(keys[0].flags, 257);
39  assert.equal(keys[0].algorithm, 13);
40  assert.equal(keys[0].protocol, 3);
41  assert.ok(keys[0].publicKey.includes('...'));
42});
43
44test('parseDnskeyData returns empty for no records', () => {
45  assert.deepEqual(parseDnskeyData([]), []);
46  assert.deepEqual(parseDnskeyData([{ name: 'example.com', type: 48, data: '' }]), []);
47});
48
49test('classifyDnskeyFlags identifies KSK (flags 257)', () => {
50  // 257 = 0x101 = zone key (bit 7 = 256) + SEP (bit 15 = 1)
51  const flags = classifyDnskeyFlags(257);
52  assert.equal(flags.zoneKey, true);
53  assert.equal(flags.secureEntryPoint, true);
54  assert.equal(flags.revoked, false);
55});
56
57test('classifyDnskeyFlags identifies ZSK (flags 256)', () => {
58  // 256 = 0x100 = zone key only
59  const flags = classifyDnskeyFlags(256);
60  assert.equal(flags.zoneKey, true);
61  assert.equal(flags.secureEntryPoint, false);
62  assert.equal(flags.revoked, false);
63});
64
65test('classifyDnskeyFlags identifies revoked key (flags 384)', () => {
66  // 384 = 256 + 128 = zone key + revoke bit
67  const flags = classifyDnskeyFlags(384);
68  assert.equal(flags.zoneKey, true);
69  assert.equal(flags.secureEntryPoint, false);
70  assert.equal(flags.revoked, true);
71});
72
73test('classifyDnskeyFlags handles null', () => {
74  const flags = classifyDnskeyFlags(null);
75  assert.equal(flags.zoneKey, false);
76  assert.equal(flags.secureEntryPoint, false);
77  assert.equal(flags.revoked, false);
78});
79
80test('auditDnssec returns error result for invalid domain', async () => {
81  const result = await auditDnssec({ startUrl: 'http://127.0.0.1' });
82  assert.equal(result.score, 0);
83  assert.equal(result.grade, 'F');
84  assert.ok(result.error);
85  assert.equal(result.dsAtParent.found, false);
86  assert.equal(result.dnskey.found, false);
87});
88
89test('auditDnssec returns structured output for valid domain', async () => {
90  // Live DNS check against example.com (well-known DNSSEC-signed zone)
91  const result = await auditDnssec({ startUrl: 'https://example.com', timeoutSeconds: 15 });
92  assert.equal(result.domain, 'example.com');
93  assert.equal(result.error, null);
94  assert.equal(typeof result.score, 'number');
95  assert.ok(result.score >= 0 && result.score <= 100);
96  assert.ok(['A', 'B', 'C', 'D', 'F'].includes(result.grade));
97  assert.ok(Array.isArray(result.issues));
98  assert.ok(Array.isArray(result.recommendations));
99  assert.ok(result.checkedAt);
100  // example.com is DNSSEC-signed, so should have DS at parent
101  assert.equal(result.dsAtParent.found, true);
102  assert.ok(result.dsAtParent.recordCount > 0);
103  // Should have DNSKEY
104  assert.equal(result.dnskey.found, true);
105  assert.ok(result.dnskey.keyCount > 0);
106}, 20000);

DNSSEC Readiness Checker

junipr/dnssec-readiness-checker

Check DNSSEC readiness/status signals such as DNSKEY, DS, RRSIG, and signed-chain hints.

junipr

DNSSEC Chain Auditor

q_services/dnssec-chain-auditor

Audit DS and DNSKEY presence, authenticated validation, signing algorithms, digest types and delegation consistency for domain portfolios.

Q Services

DNSSEC Chain & Rollover Monitor

monema/dnssec-chain-rollover-monitor

Monitor public domains for DS/DNSKEY chain mismatches, DNSSEC signature expiry, and key-rollover drift with persistent cross-run history.

Maarten Vreeburg

DNS Lookup - Bulk DNS Records & DNSSEC

blackfalcondata/dns-lookup

Bulk DNS record lookup: A, AAAA, MX, TXT, CNAME, NS, SOA and CAA records plus DNSSEC status for every domain, with per-record-type control and incremental change tracking. WHOIS, SSL, HTTP and email-auth checks available for a full domain audit. $1 per 1,000 domains.

Black Falcon Data

Domain Intel (RDAP)

conserving_mastodon/domain-intel

Registration age, expiry, registrar, status flags, nameservers, and DNSSEC for any domain via RDAP over HTTPS - the modern replacement for port-43 WHOIS. Flags newly-registered domains, imminent expiry, hold/pending-delete states, and missing DNSSEC. Charged only on completed lookups.

Chris Arsenault

Email Deliverability Checker

blackfalcondata/email-deliverability-checker

Bulk email deliverability audit: SPF, DMARC, DKIM and DNSSEC records, MX configuration and domain blacklist status for every sending domain, rolled into an A-F inbox-readiness grade with a 0-100 score and incremental drift monitoring. $1 per 1,000 domains.

Black Falcon Data

DNS & Domain Intelligence Scraper (SPF, DMARC, DKIM, DNSSEC)

scrapers_lat/dns-domain-intelligence-scraper

Resolve full DNS records for any domain via DNS-over-HTTPS: A, AAAA, MX, NS, TXT, SOA, CAA, plus parsed SPF, DMARC, DKIM, DNSSEC and mail-provider intelligence. Ideal for OSINT, attack-surface mapping, email-security audits and KYB. Export to JSON, CSV or Excel.

Scrapers Lat

🌐 Domain Intelligence Scraper - WHOIS & Domain Age

benthepythondev/domain-intelligence-scraper

Extract domain registration data including age, expiry dates, registrar, nameservers, and DNSSEC status using free RDAP/WHOIS APIs. Perfect for SEO, lead generation, and security research

Ben

WhoIs Domain Lookup Tool

aetheragent/whois-domain-lookup

Perform detailed WhoIs lookups on any domain. Get registrant info, registrar details, creation/expiry dates, nameservers, DNSSEC status, and domain status codes. Essential for domain investors, security researchers, and competitive intelligence gathering.

Grant Mitchell

Domain Intelligence (RDAP and DNS)

agentictools/domain-intelligence

Bulk domain lookups over official RDAP registry data plus live DNS records. Registrar, dates, status, nameservers, DNSSEC, and A, MX, NS, TXT records.