> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/observer/which-dns-validation-tests-does-the-enginsight-observer-perform.md).

# Which DNS validation tests does the Enginsight Observer perform?

The Observer is an Enginsight component that can be installed on systems at different locations to monitor endpoints externally. In Enginsight, endpoints are internal and external websites and domains.

Monitoring also includes checking the endpoint for security-relevant DNS records. These are instructions on DNS servers that connect domain names with IP addresses and other services.

***

## DNS Record Checks

In general, the Enginsight Observer checks whether the following DNS records exist and work correctly:

<table><thead><tr><th width="146.54296875">DNS record</th><th>Description</th></tr></thead><tbody><tr><td>A</td><td>The DNS record type A (Address) links a human-readable domain name such as <em>example.com</em> to a machine-readable IPv4 address.</td></tr><tr><td>AAAA</td><td>The DNS record type AAAA (Quad-A) links a human-readable domain name such as <em>example.com</em> to a machine-readable IPv6 address.</td></tr><tr><td><a href="#caa-record-certification-authority-authorization">CAA</a></td><td>The DNS record type CAA (Certification Authority Authorization) defines which certificate authority (CA) is allowed to issue SSL/TLS certificates for a specific domain. This helps prevent abuse.</td></tr><tr><td>CNAME</td><td>The DNS record type CNAME (Canonical Name) points a domain or subdomain name to another domain name as an alias. For example, this allows <em>www.example.com</em> to point to <em>anotherexample.example.com</em> via a CNAME record.</td></tr><tr><td><a href="#dmarc-record">DMARC</a></td><td>The DNS record type DMARC (Domain-Based Message Authentication, Reporting and Conformance) defines how email servers should handle messages that fail authentication. This can prevent fraudsters from using a domain for spoofed emails and helps legitimate emails avoid being incorrectly classified as spam.</td></tr><tr><td>MX</td><td>The DNS record type MX (Mail Exchange) tells the internet which email servers are responsible for receiving emails for a specific domain and in which order they should be queried.</td></tr><tr><td>NS</td><td>The DNS record type NS (Name Server) specifies which name server is authoritative for a specific domain or subdomain, meaning which server manages the actual DNS records. It also acts as a directory so that websites can be found.</td></tr><tr><td>PTR</td><td>The DNS record type PTR (Pointer) maps an IP address to a domain name. It is used for reverse DNS lookups (rDNS) to verify whether an IP address actually belongs to the domain name it claims to belong to.</td></tr><tr><td>SOA</td><td>The DNS record type SOA (Start of Authority) contains administrative metadata such as the primary name server, the administrator's email address, a serial or version number, and more. It appears at the beginning of a file and is mandatory.</td></tr><tr><td><a href="#spf-record-sender-policy-framework">SPF</a></td><td>The DNS record type SPF (Sender Policy Framework) defines which email servers are authorized to send emails on behalf of a domain. This prevents fraudsters from misusing a domain to send emails.</td></tr></tbody></table>

***

## Specific DNS Validation Tests

To prevent misuse of a domain, the Observer performs specific validation tests for CAA, DMARC, and SPF DNS records, which we will explain in more detail below.

### CAA Record <a href="#caa-record-certification-authority-authorization" id="caa-record-certification-authority-authorization"></a>

The DNS record type CAA (Certification Authority Authorization) defines which certificate authority (CA) is allowed to issue SSL/TLS certificates for a specific domain.

The Observer checks for the following:

<table><thead><tr><th width="217.234375">Validation test</th><th>Description</th></tr></thead><tbody><tr><td>Missing DNS record</td><td>The DNS record does not exist. This contradicts the recommendations for a correct DNS configuration.</td></tr><tr><td>Missing contact address for DNS CAA</td><td>No contact address has been assigned (iodef).</td></tr><tr><td>Invalid contact address for DNS CAA</td><td>The contact address (iodef) contains characters that are invalid for emails and/or uses an invalid email format (not <em>abc@def.com</em>).</td></tr><tr><td>Unconventional certification authority</td><td>The certificate authority used (issue, wildissue) is not on our whitelist. This whitelist includes: letsencrypt.org, globalsign.com, sectigo.com, camerfirma.com, accv.es, actalis.it, amazon.com, pki.apple.com, atos.net, buypass.com, aoc.cat, certigna.fr, www.certinomis.com, ecert.gov.hk, certsign.ro, certum.pl</td></tr></tbody></table>

### DMARC Record

The DNS record type DMARC (Domain-Based Message Authentication, Reporting and Conformance) defines how email servers should handle messages that fail authentication, for example when the domain is used to send an email from an unauthorized IP address.

The Observer checks for the following:

<table><thead><tr><th width="257.85546875">Validation test</th><th>Description</th></tr></thead><tbody><tr><td>Missing DNS record</td><td>The DNS record does not exist. This contradicts the recommendations for a correct DNS configuration.</td></tr><tr><td>Invalid DMARC policy</td><td><p>The DMARC policy (p) does not have a common value. Common values are:</p><ul><li><strong>none</strong><em>:</em> Sending emails is not affected. You only receive a notification.</li><li><strong>quarantine</strong><em>:</em> Emails that fail the DMARC check are delivered to the recipient's spam folder.</li><li><strong>reject</strong><em>:</em> Emails that fail the DMARC check should be rejected by the recipient.</li></ul></td></tr><tr><td>Invalid DMARC subdomain policy</td><td><p>The DMARC subdomain policy (sp) does not have a common value. Common values are:</p><ul><li><strong>none</strong><em>:</em> Sending emails is not affected. You only receive a notification.</li><li><strong>quarantine</strong><em>:</em> Emails that fail the DMARC check are delivered to the recipient's spam folder.</li><li><strong>reject</strong><em>:</em> Emails that fail the DMARC check should be rejected by the recipient.</li></ul></td></tr><tr><td>Invalid DMARC percentage filter value</td><td>The optional percentage filter value (pct) can be used to define what percentage of messages should be filtered. The value must therefore be between 1 and 100.</td></tr><tr><td>Invalid DMARC aggregate report email</td><td>The report email address contains invalid characters or uses an invalid email format (not <em>abc@def.com</em>).</td></tr><tr><td>Invalid DMARC protocol version</td><td>The DMARC version (v) must be DMARC1.</td></tr></tbody></table>

### SPF Record <a href="#spf-record-sender-policy-framework" id="spf-record-sender-policy-framework"></a>

The DNS record type SPF (Sender Policy Framework) defines which email servers are authorized to send emails on behalf of a domain.

The Observer checks for the following:

<table><thead><tr><th width="265.84765625">Validation test</th><th>Description</th></tr></thead><tbody><tr><td>Missing DNS record</td><td>The DNS record does not exist. This contradicts the recommendations for a correct DNS configuration.</td></tr><tr><td>Deprecated SPF version</td><td>The SPF version (v) must be SPF1.</td></tr><tr><td>Multiple SPF records found</td><td>Multiple SPF records are used, which does not comply with the requirements of a correct DNS configuration. Multiple SPF records must therefore be merged into a single record.</td></tr><tr><td>SPF record contains characters after ALL</td><td>There are additional characters after the ALL entry, which does not comply with the requirements of a correct DNS configuration. No further entries may follow the optional ALL entry.</td></tr><tr><td>Invalid SPF syntax</td><td>The SPF record contains unknown entries (known entries are: spf1, mx, ip4, ip6, exists, include, all, a, redirect, exp, ptr) and/or disallowed characters.</td></tr></tbody></table>

***