DNS Inspection in VitalSite
How VitalSite uses Node’s native DNS resolver to validate SPF, DMARC, DKIM, and CAA records with no third-party dependency.
Some of the most important security signals live in your DNS records, not your web server. VitalSite inspects them directly using Node.js’s built-in dns module — no external service, no extra cost, and no data shared with a third party.
What it provides
Node’s DNS resolver lets VitalSite query the public DNS records for your domain in real time: TXT records for SPF and DMARC, DKIM selectors, and CAA records. This is the same data any mail server consults when deciding whether to trust an email claiming to be from you.
Why we use it
Email-authentication DNS is the front line against domain spoofing and phishing — and it’s invisible from the website itself, so most scanners ignore it. By reading these records directly, VitalSite can tell you whether attackers can impersonate your domain in email, and whether certificate issuance is restricted to authorities you trust.
How VitalSite uses it
The DNS Security Records check uses the resolver to verify:
- SPF — which servers may send mail as your domain.
- DMARC — the enforcement policy, graded from p=none (monitoring only) up to p=reject (full protection).
- DKIM — message-signing keys on common selectors.
- CAA — which certificate authorities may issue for your domain.
Because it’s built into Node, this check is fast, reliable, and runs on every scan without any API key. Our email security guide explains how to configure each record.
Every VitalSite scan draws on this source automatically. Run a free full-domain scan to see your results, or compare plans and pricing.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.