(cache)Domain Overview | Domain Detective

Web edition overview

This web edition shows the DD sections that run safely in the browser. Deeper sections stay visible below and are marked clearly when they need the broader online run.

Try

Web edition coverage Partial browser support The GitHub Pages edition runs the DD checks that are safe through browser DNS and keeps deeper network sections visible as deeper-run work.

Runs here

DNS inventory, provider hints, and DNS application fingerprints
Core mail authentication and transport DNS controls
Browser-safe evidence ledger and posture notes

Deeper run adds

HTTP headers, security.txt, and TLS certificate handshake details
RDAP registration data and DNSBL/exposure checks
Certificate Transparency subdomain discovery

Run deeper locally

Install-Module DomainDetective -Scope CurrentUser
Import-Module DomainDetective
$check = Get-DomainHealthCheck -Domain "primus-design.com"

Recent runs

Web edition overview

This view uses the DD checks that run cleanly in the browser. Sections that need deeper online validation stay visible below and are marked clearly.

Updated 2026-06-26 18:37:59 Age 41s ago Live result Full reportCompleted 2026-06-26 18:37:59

Ready The baseline DD posture summary is already available.

Domain posture overviewWarning

Assessments 28

DD merged mail, web, registration, and exposure findings into the overview assessment count shown here.

Warnings: 6Errors: 0

DNS Inventory: TXT verification/service tokens present: Google Site Verification
DNS Inventory: Apex AAAA record missing (A is present).
DNS Inventory: Incomplete IPv6 support detected: apex AAAA missing; no AAAA for NS hosts (checked 2).

Mail and DNS 2 pass

The mail and DNS posture combines SPF, DKIM, DMARC, MX, transport policy, and DNS infrastructure into one DD control surface.

Failing controls: 8Checks: 12

SPF: ~all
DKIM: Missing
DMARC: Missing

Web posture Offline

DD blends HTTP reachability, certificate posture, and disclosure metadata to summarize the exposed web surface.

HTTP not reachableSecurity.txt missing

Security.txt: Missing

Providers GoogleWorkspace

Mail routing, authoritative DNS, and detected DNS application fingerprints shape the provider footprint DD reports here.

DNS: UnknownDetected apps: 2

GoogleWorkspace: MxRecord
Google Site Verification: TxtRecord

Exposure 0 subdomains

DD uses subdomain discovery and external application clues to outline the domain’s visible exposure surface.

Detected apps: 2Resolving: 0

Registration Expiry unknown

Registration timing, registrar context, and DD hinting combine here to summarize the registration and lifecycle posture.

Hints: 3Expiry not observed

Publish a valid DMARC record.
Ensure DKIM selectors have valid keys.

Web edition DD overview built from web-ready DNS, mail, and application evidence. Web, certificate, registration, and exposure sections are marked clearly when they need deeper online validation.

Mail provider: GoogleWorkspace
SPF: ~all (2/10 lookups)
DKIM: Missing (No selectors were discovered.)
DMARC: Missing (No DMARC policy published.)
MX: 5 record(s) (Google Workspace)

Control prioritiesInfo

Controls needing follow-up

SPF ~all

Needs follow-upMail authentication

DD found this mail authentication control, but it still needs follow-up in the current overview run.

2/10 lookups

DKIM Missing

Needs remediationMail authentication

DD marked this mail authentication control for remediation in the current overview run.

No selectors were discovered.

DMARC Missing

Needs remediationMail authentication

DD marked this mail authentication control for remediation in the current overview run.

No DMARC policy published.

MX 5 record(s)

Needs follow-upMail transport

DD found this mail transport control, but it still needs follow-up in the current overview run.

Google Workspace

MTA-STS Missing

Needs remediationMail transport

DD marked this mail transport control for remediation in the current overview run.

No MTA-STS policy published.

TLS-RPT Missing

Needs remediationMail transport

DD marked this mail transport control for remediation in the current overview run.

No TLS reporting record published.

BIMI Missing

Needs remediationMail authentication

DD marked this mail authentication control for remediation in the current overview run.

No BIMI record published.

CAA Missing

Needs remediationTrust and DNS hardening

DD marked this trust and dns hardening control for remediation in the current overview run.

No CAA restrictions published.

Healthy controls

NS 2 nameserver(s)

HealthyDNS infrastructure

DD marked this dns infrastructure control as healthy in the current overview run.

ASN diversity: 1

SOA 2026062415

HealthyDNS infrastructure

DD marked this dns infrastructure control as healthy in the current overview run.

ns1.value-domain.com / refresh 3600s

DNSBL Clear

HealthyExposure

DD marked this exposure control as healthy in the current overview run.

6 target(s), 0 listing(s)

Action planInfo

Do next

Strengthen SPF policy to -allImproves spoof resistance at receivers that evaluate SPF strictly.

Softfail/neutral (~all/?all) do not enforce rejection and allow spoof attempts to be accepted more easily.

Area: SpfEffort: LowImpact: Improves spoof resistance at receivers that evaluate SPF strictly.spfpolicy

How: After validating legitimate senders, switch to '-all' for enforcement. Coordinate with DMARC so alignment continues to pass.
Verify: Mail from authorized IPs passes; unauthorized sources fail with -all.
Reference: https://www.rfc-editor.org/rfc/rfc7208#section-5.1

Normalize MX prioritiesLow effort

Misordered priorities can confuse troubleshooting and automated tooling.

Area: Email authEffort: Lowmx

How: Use ascending MX preference values; duplicates are allowed to load-balance.

Publish an MTA-STS policyLow effort

Without MTA-STS, SMTP TLS remains opportunistic and subject to downgrade.

Area: TlsEffort: Lowmta-ststls

How: Publish a DNS TXT at _mta-sts.<domain> and host https://mta-sts.<domain>/.well-known/mta-sts.txt with valid mode/max_age/mx.
Reference: https://www.rfc-editor.org/rfc/rfc8461

No DANE TLSA records foundReduced resilience against MITM for TLS connections.

Without DANE, SMTP/HTTPS clients cannot pin certificates via DNSSEC.

Area: TlsEffort: MediumImpact: Reduced resilience against MITM for TLS connections.danetlsadnssec

How: Publish TLSA records at _<port>._<proto>.<host> with correct usage/selector/matching values.
Verify: dig _25._tcp.mail.example.com TLSA and validate fields.

DNSKEY RRset not authenticatedLow effort

Without authenticated DNSKEY, validators cannot build a trust chain for your zone.

Area: DnssecEffort: Lowdnssec

How: Ensure authoritative servers sign DNSKEY RRset and provide valid RRSIGs; check key publishing and rolling procedures.

Missing DS at parentLow effort

Without a DS record in the parent zone, DNSSEC validation cannot succeed.

Area: DnssecEffort: Lowdnssec

How: Publish a DS record for your zone at the parent registry; coordinate with your registrar.

Keep in place

No DNSBL listings detected

The queried host or domain was not listed by any checked DNSBL provider.

Area: Threat intelKeep in placednsblclean

How: Monitor periodically to ensure continued clean reputation.
Verify: Repeat the check; expect NXDOMAIN or not listed responses.

DNSBL scan summary

Aggregated outcome of DNSBL checks across providers and inputs.

Area: Threat intelKeep in placednsblsummary

How: Use as a high-level metric; investigate 'listed' details if any providers reported a listing.
Verify: Re-run checks or inspect per-host DNSBLRecords in raw results.

Redundant MX hosts configured

Multiple MX hosts improve resilience and availability of inbound mail.

Area: Email authKeep in placemxresilience

How: Maintain at least two MX records with differing preferences hosted on separate infrastructure.

Share and reopenInfo

Ready Mail and DNS controls are fully included in this result.

Mail and DNS securityInfo

SPF ~all

Needs follow-upMail authentication

2/10 lookups

DKIM Missing

Needs remediationMail authentication

No selectors were discovered.

DMARC Missing

Needs remediationMail authentication

No DMARC policy published.

MX 5 record(s)

Needs follow-upMail transport

Google Workspace

MTA-STS Missing

Needs remediationMail transport

No MTA-STS policy published.

TLS-RPT Missing

Needs remediationMail transport

No TLS reporting record published.

BIMI Missing

Needs remediationMail authentication

No BIMI record published.

CAA Missing

Needs remediationTrust and DNS hardening

No CAA restrictions published.

DANE Missing

Needs remediationTrust and DNS hardening

No TLSA records published.

DNSSEC Broken

Needs remediationTrust and DNS hardening

0 DS, 0 DNSKEY

NS 2 nameserver(s)

HealthyDNS infrastructure

ASN diversity: 1

SOA 2026062415

HealthyDNS infrastructure

ns1.value-domain.com / refresh 3600s

Needs deeper run Web headers, certificates, security.txt, and registration data need the deeper online run.

Web, registration, and exposureInfo

Web headers, certificates, security.txt, and registration data need the deeper online run.

Ready Detected DNS application evidence is already available.

Detected applications and servicesInfo

Analytics 1 app(s)

DD matched 1 provider or application signal(s) in this category. Expand to review the detailed evidence cards.

Show analytics matches (1)

Google Site Verification

TXT matched Google Site Verification across 1 observation.

Confidence: Moderate1 observation(s)Observed on TXTTXT

TXT: google-site-verification=Lvvvcptgd-ctYbtwEIEQMf_CbxBxen3bEq7CyFEiLKY

Other 1 app(s)

DD matched 1 provider or application signal(s) in this category. Expand to review the detailed evidence cards.

Show other matches (1)

GoogleWorkspace

MX matched GoogleWorkspace across 1 observation.

Confidence: Strong1 observation(s)Observed on DnsInventory.MailProviderMX

MX: MX alt3.aspmx.l.google.com matches alt3.aspmx.l.google.com

Ready These cards explain which DD evidence sources drove the current domain posture.

Why DD reached this postureInfo

Evidence coverage 18 control findings

DD combined mail, DNS, web, registration, and exposure checks into the domain posture shown on this page. This card summarizes how broad that evidence set was.

Mail/DNS checks: 12Web/registration checks: 6Assessments: 28

SPF: ~all
DKIM: Missing
HTTP: Offline
Certificate: Missing

Provider and app surface 2 app hint(s)

Provider, routing, and third-party application evidence all contributed to DD's view of the domain's public operating surface.

Mail: GoogleWorkspaceDNS: UnknownSubdomains: 0

Mail provider: GoogleWorkspace
Google Site Verification via TXT
GoogleWorkspace via DnsInventory.MailProvider

Web and registration surface 0 core sources available

DD blended HTTP, certificate, disclosure, DNSBL, and RDAP sources to judge the outward-facing web and registration surface for this domain.

HTTP offlineNo security.txtExpiry unknown

HTTP: Unknown / No HSTS
Certificate: review needed
DNSBL: clear

Show evidence details (5 cards)

Provider signals 2 app hints

DD correlated DNS inventory, mail routing, and application fingerprints to infer provider posture for this domain.

Mail: GoogleWorkspaceDNS: Unknown

Mail provider: GoogleWorkspace

Mail and DNS posture 2 pass

DD combined SPF, DKIM, DMARC, MX, transport policy, and authoritative DNS checks into the mail-security posture shown on this page.

SPF ~allDKIM MissingDMARC MissingMX 5 record(s)MTA-STS Missing

SPF: ~all (2/10 lookups)
DKIM: Missing (No selectors were discovered.)
DMARC: Missing (No DMARC policy published.)
MX: 5 record(s) (Google Workspace)

Application footprint evidence 2 detected

DD used DNS application fingerprints to infer third-party services and provider overlap across the domain.

2 application match(es)0 subdomain(s)

Google Site Verification via TXT
GoogleWorkspace via DnsInventory.MailProvider

Web posture evidence Offline

HTTP response behavior, TLS certificate posture, and disclosure controls contribute to the web-facing DD assessment for the domain.

HTTP offlineTLS issuessecurity.txt missing

Registration evidence Unavailable

Registration evidence was not available during the DD run.

Registrar: UnknownNo contact entityNo hold status

Posture notesInfo

Provider notes 2 provider hints

DD combined DNS inventory, routing, and application fingerprints to summarize the provider footprint behind this domain.

Mail: GoogleWorkspaceDNS: UnknownApps: 2

GoogleWorkspace: MxRecord
Google Site Verification: TxtRecord
Mail provider: GoogleWorkspace

Web and registration notes Offline

DD blended web reachability, certificate/security metadata, and registration timing into these posture notes.

HTTP not reachableSecurity.txt: missing

Publish a valid DMARC record.
Ensure DKIM selectors have valid keys.
Sign zones and publish DS records.

Exposure notes 0 subdomain(s)

DD used subdomain discovery, naming sensitivity, and certificate context to summarize the external exposure profile.

Observed: 0Resolving: 0High sensitivity: 0

Ready All DD recommendations and positive findings are included.

AssessmentsInfo

Severity mix 28 finding(s)

DD assessments are grouped here by severity so the overview shows how much of the current result is error-driven, warning-driven, or informational.

Errors: 0Warnings: 6Info: 22

DANE: No DANE records found.
DNSSEC: DNSKEY for primus-design.com not authenticated
DNSSEC: No DS record for primus-design.com

Primary categories 9 category(ies)

These categories produced the most DD findings in the current overview and usually point to the main posture themes worth reviewing first.

DNSBLSPFDNS Inventory

DNSBL: 7 finding(s)
SPF: 6 finding(s)
DNS Inventory: 4 finding(s)
SOA: 4 finding(s)

Assessment coverage 6 target(s)

This shows how broadly the DD findings are distributed across concrete sources and targets instead of appearing only as generic summary messages.

Sources: 0Targets: 6

Target: 142.250.101.27
Target: 172.217.216.27

Top findings

DANE: No DANE records found.
DNSSEC: DNSKEY for primus-design.com not authenticated
DNSSEC: No DS record for primus-design.com
General: MX priorities are not in ascending stable order
MTASTS: No MTA-STS DNS bootstrap record published.

Show findings (28)

Warning DANE.NoRecords — No DANE records found.
Warning DNSSEC.DNSKEY.NotAuthenticated — DNSKEY for primus-design.com not authenticated
Warning DNSSEC.DS.Missing — No DS record for primus-design.com
Warning MTASTS.Record.Missing — No MTA-STS DNS bootstrap record published.
Warning MX.Priority.OutOfOrder — MX priorities are not in ascending stable order
Warning SPF.All.Soft — SPF ends with '~all'. Consider '-all' once senders are validated.
Info DNSBL.NotListed — Not listed on any DNSBL
Info DNSBL.NotListed — Not listed on any DNSBL
Info DNSBL.NotListed — Not listed on any DNSBL
Info DNSBL.NotListed — Not listed on any DNSBL
Info DNSBL.NotListed — Not listed on any DNSBL
Info DNSBL.NotListed — Not listed on any DNSBL
Info DNSBL.Summary — Checked 123 providers across 6 hosts; listed 0/6.
Info DNSINV.Apex.AAAA.Missing — Apex AAAA record missing (A is present).
Info DNSINV.IPv6.Incomplete — Incomplete IPv6 support detected: apex AAAA missing; no AAAA for NS hosts (checked 2).
Info DNSINV.ResultsPresent — Captured 14 DNS record(s) across 8 record type(s).
Info DNSINV.TXT.Signals.Exposed — TXT verification/service tokens present: Google Site Verification
Info MX.Success.RedundantHosts — Multiple MX preferences detected
Info NS.Diversity.High — Authoritative NS are diverse across networks/providers (ASNs: 1)
Info SOA.Expire.Sane — SOA Expire value is within recommended range: 604800
Info SOA.MNAME.MatchesNS — SOA MNAME matches published NS records
Info SOA.Refresh.Sane — SOA Refresh value is within recommended range: 3600
Info SOA.Retry.Sane — SOA Retry value is within recommended range: 900
Info SPF.Flattened.IpSetOptimized — Flattened SPF IP set has no duplicates
Info SPF.Include.ChainValid — SPF include/redirect chain resolves without loops
Info SPF.Lookups.WithinLimit — DNS lookups within limit: 2/10
Info SPF.Record.Present — SPF record present
Info SPF.Record.StartsV1 — SPF starts with v=spf1

Run with CLI, PowerShell, or C#

Install & run

$ dotnet tool install -g DomainDetective.CLI
$ domaindetective check 'example.com'