DNS & email
Changed DNS records are often the first sign of hijacking, forgotten migrations or misconfiguration. XICTRAQ monitors every important record type 24/7 (Free every 24 h, paid every 6 h), compares each new query against the previous snapshot and flags any deviation — including email authentication checks (SPF, DKIM probing 22 common selectors, DMARC with policy parsing).
# DNS records
Per domain, A, AAAA, MX, NS, TXT, CNAME and CAA are queried regularly — A, AAAA, MX, NS, TXT, CNAME using the local resolvers of the active EU monitoring nodes. CAA records are first queried natively and fall back to a DoH resolver (Google, or Cloudflare in the separate CAA run) when empty, since many local resolvers do not return CAA reliably. On demand, a side-by-side resolver comparison against Google (DoH), Cloudflare (DoH) and AdGuard (DoH) can be triggered to detect geo-split DNS or propagation lag.
DNS Records
Grouped by record type — incl. CAA, SOA, SRV, DMARC, MTA-STS, TLS-RPT
CAA restricts which certificate authorities may issue a certificate for this domain.
Recommendation: CAA is cleanly configured and covers the active issuer. Changes to the entries are monitored continuously.
# Email authentication (SPF / DKIM / DMARC)
Misconfigured SPF/DKIM/DMARC is the most common reason emails land in spam — or why phishing mails using your domain name go unnoticed. XICTRAQ parses the records, validates them syntactically and semantically and proposes concrete improvements.
Email security
Are my mails landing in spam? SPF, DKIM, DMARC, BIMI, MTA-STS & DNSSEC
Switch to -all (hard fail) once all servers are covered.
DKIM cryptographically signs outbound mail.
Enforced policy protects against spoofing of your domain.
Brand logo appears in the inbox of supported providers.
TLS delivery is enforced (protection against downgrade).
DNS responses are protected against tampering.
Correctly configured SPF, DKIM and DMARC reduces the risk of your mail landing in spam and makes it harder to abuse your domain for phishing.
# Email security assessment (deliverability & spam protection)
Beyond a simple presence check, XICTRAQ assesses how effectively your email setup actually protects against spam classification and domain abuse. From SPF, DKIM, DMARC, BIMI, MTA-STS and DNSSEC it derives an overall score plus a spam-risk rating and concrete recommendations. A clean configuration reduces the risk of mail landing in spam — inbox placement can never be technically guaranteed, since providers apply their own filtering rules. The assessment is produced when a website is scanned (Scan → Network); the website's Network tab shows the continuously measured SPF, DKIM and DMARC records.
DMARC policy levels (none / quarantine / reject)
DMARC is the central spam-protection signal. XICTRAQ reads the policy from the _dmarc record: p=none only monitors (no active protection, rated “weak”), while p=quarantine and p=reject enforce authentication (rated “strong”). It additionally checks pct (share of covered mail) and rua (report address) — an enforced policy with pct=100 makes abuse of your domain for phishing considerably harder.
SPF qualifier rating (-all / ~all / ?all)
XICTRAQ does not only read whether an SPF record exists, but also its closing mechanism: -all (hard fail) is rated “strong”, ~all (soft fail) “medium”, ?all (neutral) and +all (pass-all) “weak”. If the all mechanism is missing entirely, the record counts as incomplete. You instantly see whether your SPF actually rejects spoofed senders or merely marks them.
BIMI readiness (brand logo in the inbox)
BIMI displays your brand logo next to the sender line in supporting mailboxes. XICTRAQ checks the default._bimi record for the logo (l=) and a Verified Mark Certificate (a=, VMC). It requires an enforced DMARC policy. The readiness status shows whether only a logo is set or whether — with a VMC — Gmail and Apple Mail also display the logo.
MTA-STS (enforced TLS delivery)
MTA-STS enforces TLS-encrypted delivery of inbound mail, protecting against downgrade attacks. XICTRAQ checks the _mta-sts record and additionally fetches the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt (short timeout, fault-tolerant) to read the mode: testing (observation) or enforce (actively enforced).
Overall score & spam-risk rating
All six signals feed weighted into an overall score (DMARC and SPF weighted highest, then DKIM, then BIMI/MTA-STS/DNSSEC). This yields a grade plus a spam-risk rating (low / medium / high) and a prioritised list of concrete recommendations — from a missing SPF record to raising the DMARC policy.
# Features
Multi-resolver comparison (on demand)
The automatic DNS check uses the monitoring node's local resolver. Additionally, on demand you can trigger a side-by-side comparison of the A, AAAA, MX, NS and TXT answers against Google (DoH), Cloudflare (DoH) and AdGuard (DoH) (button “Compare now” in the Network tab). Differing A, NS or MX answers are flagged as a high-weight difference and hint at geo-split DNS or propagation lag.
Change history with diff
Every change is stored with timestamp and before/after comparison in the changelog. Useful for audit trail and rollback decisions.
DNSSEC detection
Per domain XICTRAQ checks for the presence of DS and DNSKEY records and additionally reads the AD flag (authenticated data) returned by a validating resolver. This yields a status: valid (DS, DNSKEY and AD flag present), unverified (DS and DNSKEY present but AD flag missing), no-ds (DNSKEY without a DS anchor) or unsigned. A direct DS-record match against the registrar remains on the roadmap.
CAA monitoring (allowed certificate authorities)
CAA records define which certificate authorities may issue a certificate for your domain. XICTRAQ queries the issue, issuewild and iodef entries and rates them: present and matching the actual issuer of your active certificate (strong), present (medium) or missing — in which case any public CA may issue (weak). The scan additionally checks whether the policy covers the real issuer and whether wildcard issuance is controlled. Any change to the CAA set triggers an alert (removing any restriction as critical), since CAA tampering can precede unauthorised issuance. A CAA restriction in place reduces that risk.
DMARC aggregate reports (not in service yet)
XICTRAQ does not receive DMARC aggregate reports (rua) yet: the mailbox and the analysis are not in service, and the API does not hand out a receiving address (GET /websites/:id/dmarc-token answers with 503). So do not point your DMARC record at an address under reports.xictraq.com — reports sent there would not arrive, and a replaced rua entry would be lost. Whether your DMARC record carries a rua address at all is still shown by the email rating.