Most DNS problems are not caused by attacks. They are caused by drift. A record added for a project that ended two years ago. An SPF entry for a vendor you no longer use. A subdomain pointing at a cloud resource someone deleted last spring. None of it breaks anything today, which is exactly why nobody looks at it, and why it quietly accumulates into an outage or a takeover.
A quarterly DNS audit is the discipline that catches drift before it costs you. It does not need to be a week-long project. Done properly, with a repeatable checklist and continuous monitoring handling the day-to-day, a quarterly review is a focused session that surfaces what changed, what should not exist, and what needs fixing.
This guide gives you that checklist, organized into six areas, with a free downloadable framework at the end you can use as your template.
Why Quarterly, and What It Is Not
A quarterly audit is not your monitoring. If the first time you learn about a dangling record is at your quarterly review, you have already been exposed for up to three months. Continuous monitoring catches changes as they happen; the quarterly audit catches the things automation cannot judge, whether a record should still exist, whether an owner still works here, whether a baseline is still the right baseline.
Think of it as the human layer on top of the automated one. Automation answers "what changed?" The audit answers "is any of this still correct?"
1. Inventory: Does Your List Match Reality?
Start here, because everything downstream depends on it.
- Reconcile your domain register. Pull every domain your organization owns, including defensive registrations, regional variants, and anything inherited through acquisitions. Compare it to your documented list and reconcile the gaps.
- Enumerate subdomains, including the ones nobody remembers. Most teams cannot list their full subdomain footprint. Active discovery, rather than reading your own documentation, is what surfaces the shadow DNS created by marketing campaigns, dev environments, and retired SaaS tools.
- Assign an owner to every domain and subdomain. Anything without a named owner is a candidate for removal. Unowned DNS is how drift becomes risk.
- Flag anything you cannot explain. If nobody can say why a record exists, that is a finding, not a curiosity.
2. Dangling Records and Takeover Exposure
This is the highest-severity item on the list, so treat it as the priority finding each quarter.
- Check every record pointing at a third party. CNAMEs aimed at cloud services, SaaS platforms, or CDNs are where subdomain takeover lives. Verify the target still exists and still belongs to you.
- Cross-check against decommissioned services. Ask what your teams shut down last quarter, then confirm the matching DNS records were removed. This is where the audit catches what the offboarding process missed.
- Review NS delegations. Delegated zones pointing at nameservers that no longer serve them are a takeover path most audits skip entirely.
3. Email Authentication
- Review SPF for accuracy and lookup limits. Vendors get added and never removed, and SPF has a hard limit on DNS lookups. Confirm every entry is still a service you actually use. Our SPF, DKIM, and DMARC guide covers the mechanics.
- Confirm DKIM selectors are current and that retired sending services no longer have live keys.
-
Check your DMARC policy. Has it drifted back to
p=none? Are the aggregate reports going somewhere a human reads? - Audit subdomain email policy. Subdomains without their own protection can be spoofed even when your apex domain is locked down.
4. Certificates, TLS, and DNSSEC
- Verify CAA records still list only the certificate authorities you intend to use. See our CAA records guide for what to check.
- Review TLS configuration across your public endpoints, not just the apex domain.
- Check DNSSEC signature validity and key rollover schedule. A routine rollover done wrong can take a domain offline for validating resolvers, and it fails silently for the people who broke it. Our DNSSEC guide explains the chain of trust.
5. Registration, Expiry, and Access
- Confirm expiration dates for every critical domain and that auto-renew is on with a valid payment method. A lapsed domain is the most preventable outage there is, and we cover why in our piece on domain expiration as a silent risk.
- Verify registrar lock is enabled on domains that matter.
- Review who has access to registrar and DNS provider accounts. Remove departed staff. Confirm MFA is enforced.
- Check that renewal and alert contacts point at monitored inboxes, not an individual who left.
6. Change Review and Baselines
- Read the change history for the quarter. Every change should map to a known request. Anything unexplained deserves investigation.
- Re-validate your baselines. What you defined as "correct" last quarter may not reflect this quarter's architecture.
- Close the loop on last quarter's findings. An audit that produces findings nobody remediates is theatre. Start each review by confirming the previous one's items are done.
Free Template: DNS Compliance & Governance Framework
To run this as a repeatable process, we publish a free DNS Compliance & Governance Framework as a shareable PDF. It includes a roles and responsibilities matrix, a control checklist with recommended frequencies, a risk-scoring matrix with remediation SLAs, and a summary mapping to SOC 2, ISO 27001, NIS2, DORA, and PCI-DSS. Use it as your quarterly template. No signup required, and it is free to circulate inside your organization.
Download the DNS Compliance & Governance Framework (PDF)
Making the Audit Take Hours, Not Weeks
The reason quarterly audits balloon into multi-week projects is that teams try to do the discovery, the checking, and the reviewing all in one go, manually. The fix is to let automation carry the first two so the review is the only part that needs people.
This is where DNS posture management changes the shape of the work. With continuous monitoring in place, you arrive at your quarterly review with the inventory already current, dangling records already flagged, email authentication and DNSSEC already assessed, and a change history already recorded. The audit becomes a review of findings rather than a scramble to produce them.
DNS Assistant supports exactly that: subdomain discovery to keep your inventory honest, dangling DNS detection across 22+ cloud providers, continuous record change detection with real-time alerts, email authentication and TLS posture checks, DNSSEC validation, WHOIS and expiration monitoring, a viewable change-history audit trail, and data export in CSV, Excel, or PDF for the evidence your review produces. Two honest boundaries worth stating: it detects and alerts on changes rather than gating them, and its exports are data you attach to your own documentation, not auto-generated control-mapped reports. The audit judgment stays yours; the legwork does not have to.
Start Your First Review
You can inspect a domain's records, DNSSEC status, email authentication, and TLS posture right now with the free DNS lookup tool or a Free Domain Risk Report, useful for a domain you already know about, and a reasonable way to start section 3 and 4 of this checklist today.
For the parts that need discovery and continuous coverage, finding forgotten subdomains and catching dangling records across your footprint, start free at dnsassistant.com and let the monitoring do the legwork before your next quarterly review.
Top comments (0)