Verify cryptographic DNSSEC signatures to prevent DNS cache poisoning and man-in-the-middle resolution hijacking.
Validates DS records in parent TLD zones, RRSIG expiration dates, and DNSKEY public key chains of trust.
Canonical test payload dispatched during security surface audits.
DNSSEC not enabled on apex domainWatch the probe engine test this signature in an isolated sandbox.
Enable DNSSEC at Registrar
Status: DNSSEC Unsigned
Status: DNSSEC Signed (DS record published to TLD registry)
Enable DNSSEC with your DNS provider (Cloudflare, AWS Route 53) and copy the DS record to your domain registrar.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for DNSSEC Cryptographic Validation Scanner.
Checks commonly evaluated alongside DNSSEC Cryptographic Validation Scanner during surface discovery.
Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.
Detect sensitive tokens, passwords, or PII stored in unencrypted localStorage or sessionStorage.
Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.
Audit your site across all 41 vectors automatically on every deploy.