Domain Visualizer Guide

What the tool does

Domain Visualizer resolves public DNS records for the submitted domain and shows them as a graph beside a records panel. The page keeps the overview in the graph and the detail in the panel.

• Looks the domain up through public DNS-over-HTTPS resolvers instead of reading a pasted zone file, and reuses a recent result when one is cached.
• Draws a Sankey graph from the domain to its names, record types and values, grouped by record type or by host.
• Lists every record type with its count; choose one, or a node in the graph, to read the records, with SPF and DMARC tags parsed and IP addresses looked up.
• Leaves grading to Security Posture, which scores the checks this scan runs.

Scan modes

Choose a scan mode based on how much coverage you need and how much time you want to spend collecting signals.

Visualizer asks for specific names and types; it does not list a whole zone. Records at other names, and types it does not request (such as SVCB, HTTPS, SRV outside Advanced mode, or DKIM at other selectors), are not shown even when they exist. Use Zone Analyzer with a zone export when you need every record.

How the scan's checks are scored

Domain Visualizer doesn't show a score. The checks its scan runs are graded by Security Posture with the active scoring model, and the Market Index stores the same grade for each organization. Security Posture sorts the findings onto cards: Email Security, DNS Security and TLS and Certificates from the DNS scan, and the Website Application Security card from the homepage checks described below, are scored with the severity deductions and extra penalties in the tables below. The other cards (IP and Asset Reputation, Attack Surface, Brand Protection, Network Security, Vulnerability Management, Endpoint Security, Credential Exposure, Human and Social Engineering Exposure, Trust Center and Privacy) charge set points for each finding, also set in the scoring model.

Each card starts at 100 and loses points for its findings, up to its cap. The overall score is the weighted average of the graded cards, rounded, and the letter grade comes from that number. Weights are relative: a card that isn't graded for a domain drops out and the others share its weight. The Market Index checks nine of the cards; Brand Protection, Attack Surface, Network Security, Vulnerability Management and Credential Exposure drop out of its grade. The tables below are loaded from the active scoring model when the page opens, so they show the values in use today.

Card weights and caps

Letter grades

Severity deductions

Each failing Email, DNS, TLS or website check deducts points from its card based on severity.

Extra penalties for specific findings

A few findings deduct additional points from their card on top of, or instead of, their severity deduction. These count toward the same card caps.

Security Posture website checks

The Website Application Security card in Security Posture grades what a visitor’s browser gets from the domain’s homepage. It requests the homepage the way Website Recon does, following up to five redirects, and asks for http:// once to see whether plain visits are sent to HTTPS. This runs as its own request after the DNS scan, so the card shows Checking for a moment, and results are kept for an hour. Each failed check costs the card the scoring model’s deduction for its severity (the web category’s values), and the card can lose at most 70 points.

Only the homepage is checked, and scripts are not run, so headers or cookies that other pages or scripts add aren’t seen. When no website answers, the homepage returns an error, or it can’t be reached safely, the card says Not graded and the grade comes from the other cards alone. When the homepage redirects to another site, the card grades that site, because that is what visitors get.

Security Posture vulnerability checks

The Vulnerability Management card in Security Posture looks for software versions the domain’s homepage gives away: the Server and X-Powered-By headers (for example Apache/2.4.49, OpenSSL/1.0.2k or PHP/7.4.33) and what Website Recon reads from the page, such as a WordPress generator tag or a jQuery file name. It checks up to five of them: Apache HTTP Server, nginx, OpenResty, Microsoft IIS, Apache Tomcat, OpenSSL, PHP, WordPress, Drupal, Joomla and jQuery. Each version is looked up in the National Vulnerability Database, counting only CVEs that list that product and version as vulnerable, and on endoflife.date to see whether its release line still gets fixes. IIS is checked for CVEs only, since its support ends with the Windows Server version it ships with, which the Endpoint Security card grades. This runs as its own request after the DNS scan; answers are kept for a day per version and an hour per domain.

The card can lose at most 70 points. Matching is by version number alone, so it can’t see patches applied without a version change, and software that hides its version can’t be checked. When the website names no versions, or no website answers, the card says Not graded and the grade comes from the other cards. Hiding versions doesn’t fix anything by itself; the Website Application Security card flags version headers separately.

Security Posture endpoint checks

Employee laptops, phones and the security software on them can’t be seen from outside a network, so the Endpoint Security card in Security Posture grades only what is visible. It reads the Server header from the website card’s homepage request (it runs after that request and doesn’t fetch the homepage again) and looks up two device enrollment names. It counts for about 4% of the overall grade.

An operating system that the headers don’t point to can’t be checked. Hiding it isn’t evidence of supported software, so the card then says Not graded rather than passing. End-of-life software such as old Apache, PHP or OpenSSL releases, and known vulnerabilities, are graded by the Vulnerability Management card; open ports and infected addresses on blocklists by other cards. When no website answers, the card says Not graded and the grade comes from the other cards alone.

Security Posture trust center checks

The Trust Center card in Security Posture is less a security test than a completeness check: does the organisation publish the security and compliance information that customers, auditors and procurement teams now expect, and how much of it? It reads the homepage, follows its link to a trust center or security page (or tries trust. the domain, /trust and /security), reads up to two of that page’s compliance and subprocessor pages, and checks security.txt and status. the domain. Trust centers hosted on SafeBase, Vanta, Drata, Conveyor, Whistic and similar platforms are recognised by their address or CNAME. The card weighs 10, about 4% of the overall grade.

The card can lose at most 80 points, so a domain that publishes nothing scores 20. Many trust centers on platforms draw their content with JavaScript, which can’t be read; then items that aren’t found elsewhere on the site are shown as unknown and cost nothing. Only public pages are read, so documents behind a login or request form count when the page names them. When the homepage doesn’t answer, the card says Not graded and the grade comes from the other cards.

Security Posture privacy checks

The Privacy card in Security Posture is less a security score than a completeness check: it asks whether the website has what privacy laws such as GDPR, the ePrivacy Directive, CCPA/CPRA and the newer US state laws now expect, and how complete it is. The card shows how many of those expectations are met, reads the homepage as served, the privacy policy it links to and /.well-known/gpc.json, and counts for about 4% of the overall grade.

The card can lose at most 60 points. Only the HTML the server sends is read, so a banner, a tracker or a footer link added later by a script or a tag manager can’t be seen, and whether a banner really holds trackers back until a visitor agrees can only be checked in a browser. A policy that doesn’t answer, isn’t a web page, or whose text is added by a script is counted as published but its topics aren’t checked. Which laws apply depends on where an organisation operates and its size, so treat the findings as a checklist rather than legal advice. When the homepage doesn’t answer, the card says Not graded and the grade comes from the other cards.

Investigating findings

Findings are listed in Security Posture, under the card they count toward. Choose Learn more on a finding to open its support guide, then come back to Domain Visualizer to read the records it is about. For record-level investigation of a zone file, use the right-click menu in Zone Analyzer.

Reading the graph

The Sankey graph visualizes the hierarchy of the domain’s DNS records from root, to names, to record types, to values. It is intended to make the structure of the live dataset visible at a glance instead of forcing you to inspect every row individually.

By Type starts from the record types, which suits questions such as “where does mail go?”. By Host starts from the names, such as the apex, www and _dmarc, which suits checking one name at a time. Choose a node to open its records in the panel, and ← Records to return to the list of record types.

Caching, freshness and privacy

Two separate caches affect what you see, and they expire independently.

A saved result is reused for every scan of the same domain, mode and scoring model until it expires, even if the record's DNS TTL has already passed. A result from the cache shows a Cached badge with how long ago it was taken, so check that badge after a change. Running the scan again inside the cache lifetime returns the same saved result.

Lookups use public DNS-over-HTTPS resolvers, with Cloudflare as the default. Cloudflare and Google are queried through their JSON interfaces. Quad9 is queried with standard RFC 8484 wire-format DoH, because Quad9 retired its JSON service on May 5, 2025. The resolvers receive the names Visualizer asks for from DNS Panopticon's servers, not from your browser. The saved result is keyed by domain, mode and scoring model and does not record who ran it. Rate limiting keeps a short-lived count of scans per IP address, which is not stored with the domain you scanned. Like any website, requests also pass through Cloudflare's network; the Privacy Policy covers logs and hosting.