DOMAINCHECK(1)

NAME
domaincheck - check security aspects of a second-level domain name

SYNOPSIS
domaincheck [-Vhv] [-f format] [-r resolver] [-t type]

DESCRIPTION
The domaincheck utility performs a number of DNS-based checks on the domain names given as input.

OPTIONS
The following options are supported by domaincheck:

-V  Print version number and exit.

-f format
    Specify the output format. Valid formats are 'csv', 'json', and 'text' (default: 'text'). for details.

-h  Print a short help message and exit.

-r resolver
    Use the given resolver for DNS lookups (default: stub resolver). See RESOLVER for details.

-t type
    Specify the type of check to perform (default: all). See DETAILS for a description of the supported checks.

-v  Be verbose. Can be specified multiple times.

DETAILS
Many security mechanisms can (only) be set on the second-level domain name, yet have a broad and often times not entirely obvious impact on all of its child domains.

The domaincheck utility can be used to perform a quick and simple assessment of a number of such checks. It will read second-level domain names from stdin one name per line and then perform the following checks:

CAA Identify whether the domain has any CAA records sets. See RFC8659.

DMARC
    Identify whether DMARC is set for the given domain. See RFC7489.

DNSKEY
    Identify whether the domain is has a DNSKEY record and if so, whether it has a valid DNSSEC signature. See RFC4034.

MX  Identify whether the domain has any MX records set. If so, check for the existence of a "Null MX" service record. See RFC7505.

MTA-STS
    Identify whether the domain uses SMTP MTA Strict Transport Security. See RFC8461.

SPF Identify whether the domain uses the Sender Policy Framework. See RFC7208.

TLS-RPT
    Identify whether the domain uses SMTP TLS Reporting. See RFC8460.

TXT Report on any additional DNS TXT records not relating to any of the above.

ZONEMD
    Report on the presence of the ZONEMD record. See RFC8976.

Each of these checks can be specified to the -t flag; multiple checks can be specified as a comma-separated list or as repeated flags. If no list of checks is specified, then domaincheck will perform all of the above checks.

RESOLVER
By default, domaincheck will perform DNS lookups against the default stub resolver via the operating system's standard domain name resolution library.

To use a specific resolver, the user may use the -r flag and provide a hostname or IP address, in which case domaincheck will directly query that resolver.

Finally, if the user specifies the special string 'auth' to the -r flag, then domaincheck will attempt to directly query one of the authoritative nameservers for the given domain.

EXAMPLES
To perform a full analysis of the supported aspects for the domain name 'akamai.com':

    echo akamai.com | domaincheck

To verbosely look up only CAA and SPF information for the domains found in the file 'domains':

    domaincheck -v -v -t caa,spf <domains

To generate json output for the information determined by asking the respective authoritative resolvers of each CNAME found in the 'akam.ai' zone file:

    awk '/CNAME.*\.$/ { print $NF }' akam.ai | \
            sort -u |                          \
            domaincheck -j -r auth

HISTORY
domaincheck was originally written by Jan Schaumann <jschauma@akamai.com> and Zuza Slawik <zslawik@akamai.com> in July 2022.

BUGS
Please file bug reports and feature requests via a PR in git or by emailing the authors.