DNS and Domain Security Check Checklist [FREE PDF]

DNS infrastructure is a critical attack surface, domain hijacking, DNS spoofing, and cache poisoning attacks can redirect traffic, intercept credentials, and enable phishing at scale. Regulatory frameworks including NIST CSF PR.IP-1, ISO/IEC 27001:2022 Annex A 8.20, and PCI DSS v4.0 Requirement 6.4 require organizations to secure their network infrastructure including DNS. This checklist provides a structured assessment of DNSSEC configuration, registrar security, email authentication records, a

  • Industry: Managed IT Services
  • Frequency: Monthly
  • Estimated Time: 25-40 minutes
  • Role: Network Engineer
  • Total Items: 38
  • Compliance: NIST CSF PR.IP-1 and DE.CM-1, ISO/IEC 27001:2022 Annex A 8.20, PCI DSS v4.0 Requirement 6.4.1, SOC 2 Type II CC6.6, GDPR Article 32(1)(b)

Domain Registrar & Account Security

Verify that domain registrar accounts are secured against unauthorized transfer, hijacking, and unauthorized modifications.

  • Is multi-factor authentication (MFA) enabled on all domain registrar accounts?
  • Is domain transfer lock (registrar lock) enabled for all production domains?
  • Is WHOIS privacy protection enabled to prevent public exposure of registrant contact data?
  • Are registrar account credentials unique and stored in an approved password manager or vault?
  • Are domain expiration dates monitored with automated alerts at least 60 days before expiry?
  • Is auto-renewal enabled for all production and critical domains?

DNSSEC Configuration & Validation

Assess whether DNSSEC is implemented and correctly configured to prevent DNS spoofing and cache poisoning attacks.

  • Is DNSSEC enabled and active for all production domains?
  • Have DNSSEC DS records been published at the parent zone (registrar) correctly?
  • Are DNSSEC signatures (RRSIG records) valid and not expired?
  • Are DNSSEC key rollovers performed on schedule (ZSK: monthly, KSK: annually)?
  • Is DNSSEC validation enabled on all recursive resolvers used within the organization?

DNS Server Hardening & Configuration

Verify that authoritative and recursive DNS servers are hardened, updated, and configured securely.

  • Are authoritative DNS servers patched and running a currently supported software version?
  • Is DNS zone transfer (AXFR) restricted to authorized secondary servers only?
  • Is DNS recursion disabled on authoritative DNS servers?
  • Are DNS query logs enabled and being forwarded to a SIEM or centralized log system?
  • Is rate limiting configured on recursive resolvers to mitigate DNS amplification risks?

Email Authentication DNS Records

Confirm SPF, DKIM, and DMARC records are correctly configured to prevent email spoofing and phishing.

  • Is a valid SPF (Sender Policy Framework) TXT record published for all email-sending domains?
  • Does the SPF record use '-all' (hard fail) rather than '~all' (soft fail) or '+all' (pass all)?
  • Is a DMARC TXT record published with a policy of 'quarantine' or 'reject'?
  • Is DMARC reporting (RUA/RUF tags) configured to receive aggregate and forensic email reports?
  • Are DKIM public keys published as DNS TXT records for all email-sending services?
  • Are parked or non-sending domains protected with a null SPF record and DMARC reject policy?

DNS Monitoring & Threat Detection

Verify that DNS traffic is monitored for anomalies, data exfiltration attempts, and malicious domain resolution.

  • Is DNS traffic monitored for signs of DNS tunneling or data exfiltration?
  • Is a DNS filtering or threat intelligence service (e.g., CISA protective DNS) in use?
  • Are alerts configured for unexpected changes to DNS records (zone modifications)?
  • Is there a defined process to investigate and respond to DNS anomaly alerts within 24 hours?
  • Are external DNS lookups for the organization's domains monitored for unauthorized subdomain creation?

CAA Records & Ancillary DNS Security

Validate Certification Authority Authorization records and other auxiliary DNS security configurations.

  • Are CAA (Certification Authority Authorization) DNS records published for all domains?
  • Does the CAA record include an 'iodef' tag to receive mis-issuance reports?
  • Are all dangling DNS records (pointing to decommissioned resources) identified and removed?
  • Is a negative TTL (NCACHE) configured appropriately on the SOA record to reduce negative caching issues?
  • Are DNS records for newly decommissioned subdomains or services removed within 24 hours?

DNS Change Management & Documentation

Confirm that all DNS changes follow a formal change management process with audit trails and documentation.

  • Is a formal change management process required for all DNS record modifications?
  • Are all DNS changes logged with timestamps, requester identity, and approver identity?
  • Is there a documented DNS security policy reviewed and approved within the last 12 months?
  • Have all DNS-related findings from the previous audit been remediated or formally accepted?
  • Are staff responsible for DNS management trained on DNS attack vectors and secure configuration?
  • Additional notes or observations from this DNS and domain security check?

Related Technology Checklists

Related Network Security Checklists

Why Use This DNS and Domain Security Check Checklist [FREE PDF]?

This dns and domain security check checklist [free pdf] helps managed it services teams maintain compliance and operational excellence. Designed for network engineer professionals, this checklist covers 38 critical inspection points across 7 sections. Recommended frequency: monthly.

Ensures compliance with NIST CSF PR.IP-1 and DE.CM-1, ISO/IEC 27001:2022 Annex A 8.20, PCI DSS v4.0 Requirement 6.4.1, SOC 2 Type II CC6.6, GDPR Article 32(1)(b). Regulatory-aligned for audit readiness and inspection documentation.

Frequently Asked Questions

What is a DNS and Domain Security Check Checklist [FREE PDF]?

A DNS and Domain Security Check Checklist [FREE PDF] is a standardized inspection form used by network engineer to ensure consistent managed it services operations. It contains 43 inspection points organized into 7 sections. FREE DNS & domain security checklist PDF. Audit DNSSEC, SPF, DMARC & registrar controls. Aligned with NIST CSF, ISO 27001 & PCI DSS.

How often should I use this managed it services checklist?

This checklist is designed to be completed monthly. Regular use ensures compliance with NIST CSF PR.IP-1 and DE.CM-1 and ISO/IEC 27001:2022 Annex A 8.20 and helps identify issues before they become problems.

Can I download this DNS and Domain Security Check Checklist [FREE PDF] as a PDF?

Yes, you can download this checklist as a FREE PDF for printing or offline use. The checklist includes 43 fields across 7 sections and typically takes 25-40 minutes to complete.

What compliance standards does this checklist cover?

This checklist helps ensure compliance with NIST CSF PR.IP-1 and DE.CM-1, ISO/IEC 27001:2022 Annex A 8.20, PCI DSS v4.0 Requirement 6.4.1, SOC 2 Type II CC6.6, GDPR Article 32(1)(b). Following these standards protects your organization and ensures best practices.

How do I complete this managed it services inspection checklist?

Begin by completing the header fields for Inspection Date & Time, Inspector Name, Primary Domain Name(s) in Scope, Organization Name, and Environment Type. Work through each of the 7 sections, marking items Yes or No as applicable. Add notes for any issues found. The entire process takes approximately 25 to 40 minutes.

What are the key sections in this managed it services checklist?

This managed it services checklist is organized into 7 key sections: Domain Registrar & Account Security, DNSSEC Configuration & Validation, DNS Server Hardening & Configuration, Email Authentication DNS Records, DNS Monitoring & Threat Detection, CAA Records & Ancillary DNS Security, DNS Change Management & Documentation. Each section contains specific inspection points that network engineer must verify. The structured layout ensures nothing is missed during managed it services inspections and makes the process efficient, typically taking 25-40 minutes to complete.

Who should use this DNS and Domain Security Check Checklist [FREE PDF]?

This checklist is primarily designed for network engineer working in managed it services operations. However, it is also valuable for quality assurance teams, safety officers, compliance managers, and supervisors who need to verify that managed it services standards are being met. Organizations of all sizes can benefit from using this DNS and Domain Security Check Checklist [FREE PDF] to maintain consistency and accountability.

Browse More Checklists

POPProbe