pip install cognis-dnsaudit

dnsaudit scan .            # → prioritized findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ dnsaudit-emit --version
dnsaudit 2.0.0

$ dnsaudit-emit --help
usage: dnsaudit [-h] [--version] {audit,typosquat} ...

Grade SPF/DKIM/DMARC/DNSSEC/CAA posture (A–F) and generate typosquat domains —
offline.

positional arguments:
  {audit,typosquat}
    audit            Audit a domain's DNS/email posture.
    typosquat        Generate dnstwist-style typosquat domains.

options:
  -h, --help         show this help message and exit
  --version          show program's version number and exit

Blocks above are real dnsaudit output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"feed": {
"type": "dns-audit",
"time": "2023-02-15T14:30:00Z",
"description": "DNS Audit Findings"
},
"objects": [
{
"id": "dns-1",
"category": "indicator",
"count": 5,
"values": [
{
"name": "domain",
"value": "example.com"
},
{
"name": "ip",
"value": "192.0.2.1"
}
]
},
{
"id": "dns-2",
"category": "indicator",
"count": 3,
"values": [
{
"name": "domain",
"value": "sub.example.com"
},
{
"name": "ip",
"value": "198.51.100.1"
}
]
}
]

Usage — step by step

1. Install the CLI:

   pip install dnsaudit
   

2. Audit a domain's DNS/email posture (SPF/DKIM/DMARC/DNSSEC). Pass raw records inline, or --input a JSON file:

   dnsaudit audit --domain example.com --spf "v=spf1 include:_spf.example.com -all" --dmarc "v=DMARC1; p=reject" --dnssec
   

3. Hunt typosquats of your domain across TLDs:

   dnsaudit typosquat --domain example.com --tld com --tld net --limit 50
   

4. Read the output. Use --format json and --output to persist a machine-readable report:

   dnsaudit audit --domain example.com --format json --output dns.json
   

5. Wire it into CI to gate on posture regressions:

   dnsaudit audit --input records.json --format json || exit 1
   

Contents

• Why dnsaudit? · Features · Quick start · Example · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why dnsaudit?

DNS posture & misconfiguration scanner — SPF/DKIM/DMARC/DNSSEC/CAA — without standing up heavyweight infrastructure.

dnsaudit is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Grade

• ✅ Parse Spf

• ✅ Parse Dmarc

• ✅ Audit Domain

• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer

• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

Quick start

pip install cognis-dnsaudit

dnsaudit --version

dnsaudit scan .                       # scan current project

dnsaudit scan . --format json         # machine-readable

dnsaudit scan . --fail-on high        # CI gate (non-zero exit)

Example

$ dnsaudit scan .

  [HIGH    ] DNS-001  example finding             (./src/app.py)

  [MEDIUM  ] DNS-002  another signal              (./config.yaml)



  2 findings · risk score 5 · 38ms

Architecture

flowchart LR
  IN[target / export] --> P[dnsaudit<br/>collect + correlate]
  P --> OUT[ranked findings]

Use it from any AI stack

dnsaudit is interoperable with every popular way of using AI:

• MCP server — dnsaudit mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)

• OpenAI-compatible / JSON — pipe dnsaudit scan . --format json into any agent or LLM

• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line

• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

| | Cognis dnsaudit | globalcyberalliance |

|---|:---:|:---:|

| Self-hostable, no account | ✅ | varies |

| Single command, zero config | ✅ | ⚠️ |

| JSON + SARIF for CI | ✅ | varies |

| MCP-native (AI agents) | ✅ | ❌ |

| Polyglot ports (JS/Go/Rust) | ✅ | ❌ |

| Open license | ✅ COCL | varies |

Built in the spirit of globalcyberalliance/domain-security-scanner, re-framed the Cognis way. Missing a credit? Open a PR.

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (dnsaudit mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/dnsaudit.git"    # pip (works today)

pipx install "git+https://github.com/cognis-digital/dnsaudit.git"   # isolated CLI

uv tool install "git+https://github.com/cognis-digital/dnsaudit.git" # uv

pip install cognis-dnsaudit                                          # PyPI (when published)

docker run --rm ghcr.io/cognis-digital/dnsaudit:latest --help        # Docker

brew install cognis-digital/tap/dnsaudit                             # Homebrew tap

curl -fsSL https://raw.githubusercontent.com/cognis-digital/dnsaudit/main/install.sh | sh

| Linux | macOS | Windows | Docker | Cloud |

|---|---|---|---|---|

| scripts/setup-linux.sh | scripts/setup-macos.sh | scripts/setup-windows.ps1 | docker run ghcr.io/cognis-digital/dnsaudit | DEPLOY.md (AWS/Azure/GCP/k8s) |

Related Cognis tools

• certpatrol — TLS cert lifecycle & rogue-issuance watch via Certificate Transparency

• egresswatch — Server-side outbound connection auditor — eBPF/Falco wrapper

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If dnsaudit saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---