ZoneGuard

Misconfigured DNS records, missing email security policies, and dangling cloud service pointers expose domains to spoofing and subdomain takeovers. ZoneGuard audits domain hygiene and security compliance directly from your terminal without requiring external dependencies or third-party packages. ## Key features - **Zero-Dependency DoH Engine:** Resolves DNS records (`A`, `AAAA`, `CNAME`, `MX`, `TXT`, `NS`, `SOA`, `CAA`) over HTTPS with Cloudflare and Google fallback. - **Email Security Auditing:** Validates SPF record formatting, syntax flags (`+all`, `~all`, `-all`), and DMARC enforcement policies (`reject`, `quarantine`, `none`, and `rua` telemetry). - **DNSSEC & CAA Posture Checks:** Inspects Authenticated Data (AD) flags to verify DNSSEC status and flags missing Certificate Authority Authorization (CAA) configurations. - **Dangling Takeover Detection:** Matches target hosts against known fingerprint patterns for providers like GitHub Pages, AWS S3, Heroku, and Azure. ## Example ```bash python zoneguard.py --help python zoneguard.py example.com python zoneguard.py example.com --json ``` ## Limitations ZoneGuard performs audits exclusively via DNS-over-HTTPS endpoints and basic HTTP takeover pattern matching, meaning it cannot modify remote zone files, fix records automatically, or query internal private DNS servers.

python zoneguard.py --help