DNS Security
Reduce your DNS attack surface.
DNS sprawl is how enterprises get weird incidents. We help you see what's live, what's drifting, and what's quietly risky.
Your attack surface signals
We continuously scan your DNS for exposed services, stale records, and vendor sprawl.
Signal
Severity
Details
Wildcard DNS enabled
High
*.example.com resolves to 203.0.113.42
Stale CNAME to deleted service
Medium
old-app.example.com → deleted-heroku-app.herokuapp.com
Exposed admin subdomain
High
admin.example.com publicly resolves
Unmonitored MX change
Medium
MX priority changed 3 days ago (no alert)
CAA record missing
Low
No certificate authority restrictions
Your vendor inventory (automatic detection)
We detect SaaS vendors from CNAME patterns and track trust signals (SOC2, uptime, security incidents).
Vendor
Service
Trust signal
SendGrid
Email delivery (em1234.sendgrid.net)
SOC2 Type II
Cloudflare
CDN + proxy (multiple records)
SOC2 Type II
Zendesk
Support portal (help.example.com)
SOC2 Type II
Unknown vendor
legacy-api.example.com → 203.0.113.99
No trust data
Compliance + audit export
Enterprise plan includes: vendor inventory CSV, SOC2 report links, compliance tracking
Talk to sales
Your alert policies (smart routing)
Configure how and when you get notified. Instant for critical, digest for low-risk.
Instant alerts
High-severity changes trigger immediate notifications
- DMARC policy regression
- MX record deleted
- Wildcard DNS added
- Exposed admin subdomains
Daily digest
Medium-severity changes batched into morning digest
- SPF include changes
- DKIM selector rotation
- TTL adjustments
- New CNAME detected
Weekly report
Low-severity signals + health summary
- Overall health score
- Vendor inventory updates
- Recommended actions
- Compliance status
Your continuous monitoring (alerts only when it matters)
- DNS drift detection (records change, TTL weirdness, accidental breakage)
- Deliverability posture watch (SPF/DKIM/DMARC regressions)
- Provider integrations for white-glove remediations (Cloudflare, DNSimple, Porkbun, ClouDNS, Route 53 (AWS), Google Cloud DNS, DigitalOcean DNS, Azure DNS)
Your audits get more frequent as you scale
Starter
Yearly full audit
Business
Quarterly full audit
Enterprise
Monthly full audit + tighter change alerts
We call it “continuous” because we don’t spam you with daily reports. We run checks daily in the background and notify you when something changes.