DNS Institute DNS Analyzer

Automated DNS and DNSSEC Analysis and Monitoring

DNS Institute provides detailed DNS and DNSSEC analysis via an automated monitoring system. (This is in addition to our consulting services and DNS server system checklist review.) The monitoring can be done frequently or periodically.

The DNS Institute DNS Analyzer includes over 150 tests and queries against the known name servers, including TCP and IPv6 support. (This page shows a few examples.) The reports provide explanations and bibliographic citations for all test statements, which are based on Internet standards and IETF RFC specifications, NIST and CERT guidance, US government mandates; and DNS software documented policies and best practices.

Automated monitoring checks include query response times, EDNS support, RRSIG inception and expiration, cryptographic algorithms, SOA record validity, routing diversity, approved key lengths, and much more.

We can provide reports and graphs of aggregated results. Depending on your needs, we can provide timely or delayed alerts. Contact us about monitoring your DNS as a professional service.

Miscellaneous Examples

• Broadcom — broadcom.com — RRSIG Expiration must not be expired: FAIL
• United Rentals — unitedrentals.com — Authoritative test query should not return Recursion Available flag (RA): FAIL
• Centene — centene.com — RRSIG Inception should be within one year: FAIL
• Tech Data — techdata.com — Nameserver IPv6 should be valid (RFC3056 6to4): FAIL
• State Street Corp. — spdrumobile.com — Authority Section referral should not be a root referral: FAIL
• American Financial Group — gaic.com — At least two nameserver delegations are required: FAIL
• CaixaBank SA — lacaixa.es — The nameserver must respond over TCP (TCP timeout): FAIL

See what your DNS infrastructure reveals. Schedule a free evaluation with The DNS Institute.