Bug Circuit
Free tool · no signup

Every DNS record for your domain, checked.

A, AAAA, MX, NS, TXT, CNAME, SPF and DMARC in one lookup — with the gaps that let people impersonate your domain flagged automatically.

Why DNS is the first thing an attacker reads

DNS is public by design, and it is the cheapest reconnaissance there is. Before touching your site, an attacker reads your records to learn who hosts your mail, whether you left a staging host resolving, which provider you migrated away from but never cleaned up, and — crucially — whether they can send email as you.

  • No SPF record means anyone can send mail claiming to be your domain.
  • SPF ending in ~all marks forgeries but still delivers them.
  • No DMARC means SPF and DKIM failures carry no consequence.
  • A single nameserver is one outage away from your whole domain going dark.

This tool reads all of it in one pass and tells you which of those apply to you, in plain English.

Common questions

What DNS records should every domain have?
At minimum: an A (or AAAA) record so the site loads, at least two NS records so the domain survives one nameserver failing, and — if the domain sends email — MX, SPF and DMARC records. Missing SPF or DMARC is the single most common reason a small business gets impersonated.
What does "SPF is not enforcing" mean?
An SPF record ending in ~all (softfail) or ?all (neutral) tells receiving servers to accept forged mail anyway, just marked. Only -all is a hard fail. Many domains sit on ~all for years believing they are protected.
Why does DMARC matter if I already have SPF?
SPF and DKIM decide whether a message passes a check. DMARC decides what happens when it fails, and sends you reports. Without DMARC, a failure has no consequence — so the checks are advisory only.
Is looking up DNS records legal?
Yes. DNS is public infrastructure by design; every record returned here is something any mail server or browser on the internet can read. Nothing here touches the target site.

Keep reading

Email Spoofing CheckerA deeper look at SPF, DKIM and DMARC.SSL Certificate CheckerExpiry, issuer and hostname match.Security Headers CheckerGrade your HTTP headers A–F.Manual audit from $49A person tests the application itself.

See what attackers see — free

Run the free passive check on your domain. No login, no impact on your site, results in seconds.

Passive recon only. No login, and no impact on your site. Deeper testing needs domain verification.

Ready for the full manual audit? See transparent pricing →