Check DNS Security.

It queries public DNS records of your domain and rates them: DNSSEC signature, CAA records, number and networks of the name servers, the SOA record, whether the domain and www resolve, IPv6, wildcard records and whether www points to a cloud service that no longer exists. It does not connect to your server and does not query your name servers directly.

DNSSEC signs DNS answers. Resolvers can use it to detect whether an answer was forged or altered on the way; nothing is encrypted (RFC 4033, Sections 3 and 4). Without DNSSEC your domain works normally; it only lacks this additional protection. An invalid signature, on the other hand, is critical: validating resolvers then answer with an error, and your domain cannot be reached by their users (RFC 4035, Section 5.5).

With CAA you define which certificate authorities may issue certificates for your domain. Certificate authorities must check the record before every issuance (RFC 8659, Section 3; CA/Browser Forum Baseline Requirements, Section 3.2.2.8). This makes it harder to obtain a certificate for your domain from another authority.

If a subdomain points via CNAME to a cloud service that no longer exists, a third party can create the name again at the provider and deliver their own content under your subdomain (Microsoft Learn: “Prevent dangling DNS entries and avoid subdomain takeover”). The check tests www and an entered subdomain for services where a free name returns no DNS answer (project “can-i-take-over-xyz”). Other subdomains cannot be enumerated from outside.

For the DNSSEC check, our server queries the DS and DNSKEY records of your domain from Cloudflare’s public DNS resolver (DNS over HTTPS). Cloudflare receives the domain name and the address of our server, not your IP address. All other queries go through the DNS resolver that our web server uses at the hosting provider. The result stays in memory for five minutes so that repeated requests do not query again, and is deleted after six minutes at the latest.