Validation rules
DNS Tool runs these 45 rules after every scan. Each failed rule becomes a finding with the specifics; almost all come with the impact, how to fix it and a dig command to verify it.
The severity shown is the default. Some rules raise a finding at a different severity when the risk is higher or lower — a certificate that expires in 2 days is Critical, one that expires in 25 days a Warning. Admins can switch any rule off under Settings → Validation Rules. Which plan includes which checks is listed in Plans & Pricing.
Record Health
Structural problems in a zone's records: RFC violations, risky patterns and missing records.
| Rule | Code | Checks | Default severity |
|---|---|---|---|
| Missing SOA Record | MISSING_SOA |
Zone has no SOA record (required for public zones). | Error |
| Empty Zone | EMPTY_ZONE |
Zone contains only SOA and NS records with no content records. | Info |
| Wildcard Record | WILDCARD_RECORD |
Zone contains a wildcard (*) DNS record. | Info |
| CNAME at Zone Apex | CNAME_AT_APEX |
CNAME record placed at the zone root — an RFC violation. | Error |
| CNAME Coexistence | CNAME_COEXISTENCE |
CNAME record shares a name with other record types (RFC violation). | Error |
| Deep CNAME Chain | CNAME_CHAIN_DEPTH |
CNAME chain within the zone reaches depth 5 or more. | Warning |
| Broken Delegation | BROKEN_DELEGATION |
NS record delegates to a CNAME target (RFC 2181 violation). | Error |
| Invalid MX Record | INVALID_MX |
MX record points to an IP address or a CNAME target. | Warning |
| PTR in Non-Reverse Zone | PTR_MISMATCH |
PTR record found in a non-reverse DNS zone. | Warning |
| TTL Anomaly | TTL_ANOMALY |
Record TTL is outside recommended ranges for its type. | Warning |
| Missing CAA Record | MISSING_CAA |
Public zone has A/CNAME records but no CAA record to restrict certificate issuance. | Info |
| Orphaned Private Zone | ORPHANED_PRIVATE_ZONE |
Private zone has no linked VNets — it will not resolve for any workload. | Warning |
| Missing Glue Record | MISSING_GLUE |
NS delegation points to an in-bailiwick nameserver with no glue A record. | Warning |
Email Security
Whether the domain is protected against spoofing and mail interception. Summarised on the email security scorecard.
| Rule | Code | Checks | Default severity |
|---|---|---|---|
| Missing SPF Record | MISSING_SPF |
Zone has MX records but no SPF TXT record. | Warning |
| Multiple SPF Records | MULTIPLE_SPF |
Multiple SPF TXT records on the same name (only one is permitted). | Warning |
| Permissive SPF (+all) | PERMISSIVE_SPF |
SPF record uses '+all', allowing any host to send email. | Warning |
| SPF Deprecated PTR | SPF_DEPRECATED_PTR |
SPF record uses the deprecated ptr mechanism (RFC 7208 discourages its use). | Warning |
| SPF Neutral ?all | SPF_NEUTRAL_ALL |
SPF record uses '?all' (neutral) — provides no protection against spoofing. | Warning |
| SPF No All Terminator | SPF_NO_QUALIFIER |
SPF record has no 'all' terminator and no 'redirect=' — results are unpredictable. | Warning |
| SPF Redirect With All | SPF_REDIRECT_WITH_ALL |
SPF contains both 'redirect=' and an 'all' mechanism — the redirect is ignored. | Warning |
| SPF Lookup Limit Exceeded | SPF_LOOKUP_LIMIT |
SPF include chain requires more than 10 DNS lookups (RFC 7208 limit). | Warning |
| SPF Void Lookup | SPF_VOID_LOOKUP |
SPF includes domains with no SPF record (void lookups count toward limits). | Warning |
| SPF Include Loop | SPF_INCLUDE_LOOP |
SPF include chain contains a circular reference. | Error |
| Missing DMARC Record | MISSING_DMARC |
Zone has MX records but no DMARC policy. | Warning |
| DMARC p=none Without Reporting | DMARC_NONE_POLICY |
DMARC uses 'p=none' without a reporting address (rua=). | Warning |
| Missing DKIM Record | MISSING_DKIM |
Zone has SPF and DMARC but no DKIM selector record found. | Warning |
| Invalid DKIM Record | INVALID_DKIM |
DKIM TXT record is malformed or has an empty public key. | Warning |
| Missing MTA-STS | MISSING_MTA_STS |
Public zone with MX records but no MTA-STS TXT record (RFC 8461). | Info |
| Invalid MTA-STS | INVALID_MTA_STS |
MTA-STS TXT record exists but is malformed or missing required fields. | Warning |
| Missing TLS-RPT | MISSING_TLS_RPT |
Public zone with MX records but no TLS-RPT TXT record (RFC 8460). | Info |
| Unused Domain Not Hardened | NO_MAIL_HARDENING |
Domain has no mail configuration but lacks the no-mail defaults (null MX, SPF '-all', DMARC p=reject), so it can be spoofed. | Warning |
| Invalid TLS-RPT | INVALID_TLS_RPT |
TLS-RPT TXT record exists but is malformed or missing required fields. | Warning |
Network & Delegation
Whether the zone resolves as intended on the internet and inside your Azure networks, including Private DNS.
| Rule | Code | Checks | Default severity |
|---|---|---|---|
| Dangling CNAME (Takeover Risk) | DANGLING_CNAME |
CNAME points to an Azure PaaS name that no longer resolves. | Critical |
| NS Mismatch | NS_MISMATCH |
Stored NS records differ from the live NS delegation. | Error |
| Undelegated Zone | UNDELEGATED_ZONE |
Zone exists in Azure DNS but is not delegated on the public internet. | Error |
| Split-Brain Zone | SPLIT_BRAIN_ZONE |
Private zone name matches a public zone, creating split-brain DNS. | Warning |
| Unresolvable MX Target | MX_UNRESOLVABLE |
MX target hostname does not resolve in DNS. | Warning |
| Missing Private Endpoint Record | MISSING_PE_RECORD |
Private endpoint IP has no matching A record in the private zone. | Error |
| Orphan Private Zone | ORPHAN_ZONE |
Private zone has no associated private endpoint. | Warning |
Certificate & Domain Monitoring
Certificates serving or issued for your domains, and the domains' registrations. See Certificates & domains.
| Rule | Code | Checks | Default severity |
|---|---|---|---|
| Certificate Expiry | CERT_EXPIRY |
Certificate is expiring soon. Configure how many days in advance to start warning. | Warning |
| Domain Registration Expiry | DOMAIN_EXPIRY |
Domain registration is expiring soon. Configure how many days in advance to start warning. | Warning |
| Unauthorized Certificate Authority | UNAUTHORIZED_CA |
Certificate issued by a CA the zone's CAA records don't allow. Enterprise plan. | Critical |
| NS / RDAP Mismatch | NS_RDAP_MISMATCH |
NS records in Azure DNS do not match the registrar NS data. | Warning |
| Domain Transfer Unlocked | DOMAIN_TRANSFER_UNLOCKED |
Domain registration has no transfer lock (clientTransferProhibited), so it can be moved to another registrar with only the auth code. Skipped for TLDs without registrar locks (.dk, .de). | Warning |
| Certificate Without DNS Record | CERT_WITHOUT_DNS |
A currently-valid certificate covers a hostname that has no active A/AAAA/CNAME record in the zone — a dangling-certificate / subdomain-takeover signal. | Warning |