この本文は AI(Claude)が読むための原文(英語または中国語)です。日本語訳は順次追加中。

DNS Record Analyzer

Overview

This skill queries and analyzes DNS records for domains, checking for correctness, security best practices, and common misconfigurations. It covers standard records (A, CNAME, MX) and email authentication records (SPF, DKIM, DMARC) with specific validation rules for each.

Instructions

Step 1: Query All Record Types

DOMAIN="example.com"

# Core records
dig +short A $DOMAIN
dig +short AAAA $DOMAIN
dig +short CNAME $DOMAIN
dig +short MX $DOMAIN
dig +short NS $DOMAIN
dig +short TXT $DOMAIN

# Email authentication
dig +short TXT $DOMAIN | grep "v=spf1"
dig +short TXT _dmarc.$DOMAIN
dig +short TXT default._domainkey.$DOMAIN

# Security
dig +short CAA $DOMAIN
dig +short SOA $DOMAIN

Step 2: Validate SPF

Check these rules:

Starts with v=spf1
Ends with -all (hardfail) or ~all (softfail) — recommend -all
Total DNS lookups ≤ 10 (count include:, a:, mx:, redirect=, exists:)
No duplicate mechanisms
All referenced includes resolve (no NXDOMAIN)
No +all (this allows anyone to send as your domain)

Step 3: Validate DKIM

For each sending service, check the expected selector:

Record exists and is a valid RSA public key
Key is ≥ 1024 bits (recommend 2048)
t=y (testing mode) should NOT be present in production

Step 4: Validate DMARC

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com; pct=100

Check:

p= is quarantine or reject (not none in production)
rua= is present (aggregate reports)
pct=100 (applies to all emails, not a percentage)
Subdomain policy sp= if subdomains send email

Step 5: Check MX Records

MX records exist and resolve to valid hostnames
Priority values are reasonable (lower = higher priority)
No MX pointing to IP addresses (must be hostnames)
Hostnames have valid A/AAAA records

Step 6: Produce Audit Report

Categorize findings as:

✅ Correct and secure
⚠ Works but suboptimal (with recommendation)
❌ Broken or insecure (with exact fix)

Examples

Example 1: Full Domain Audit

User prompt:

Audit all DNS records for myapp.io

Agent output:

DNS Audit — myapp.io
────────────────────

A Records:
  ✅ 104.21.45.12 (Cloudflare)
  ✅ 172.67.182.88 (Cloudflare)

AAAA Records:
  ✅ 2606:4700:3030::6815:2d0c
  ✅ 2606:4700:3037::ac43:b658

MX Records:
  ✅ 1  aspmx.l.google.com
  ✅ 5  alt1.aspmx.l.google.com
  ✅ 10 alt2.aspmx.l.google.com

NS Records:
  ✅ cody.ns.cloudflare.com
  ✅ krystal.ns.cloudflare.com

SPF:
  v=spf1 include:_spf.google.com include:sendgrid.net ~all
  ✅ Google Workspace authorized
  ✅ SendGrid authorized
  ⚠  Using ~all (softfail) — recommend changing to -all
  ✅ Lookup count: 5 of 10

DKIM:
  ✅ google._domainkey → valid 2048-bit RSA
  ❌ s1._domainkey → NXDOMAIN (SendGrid DKIM not configured!)
     Fix: Add CNAME s1._domainkey.myapp.io → s1.domainkey.u1234.wl.sendgrid.net

DMARC:
  v=DMARC1; p=none; rua=mailto:admin@myapp.io
  ❌ p=none provides no protection
     Fix: Change to p=quarantine (after fixing DKIM above)

CAA:
  ❌ No CAA records — any CA can issue certificates for your domain
     Fix: Add CAA 0 issue "letsencrypt.org" (and any other CAs you use)

Summary: 2 critical fixes, 2 recommendations

Example 2: SPF Lookup Count