All Issues
Complete reference of every issue DNS Watchdog can detect, viewable by category or by severity.
A complete reference of every issue type DNS Watchdog detects. Switch between viewing issues grouped by category or by severity.
Open Ports
| Issue | Severity | Description |
|---|---|---|
| Port 21 (FTP) | Medium | FTP transmits credentials in plaintext |
| Port 22 (SSH) | Medium | Remote shell access exposed to the internet |
| Port 23 (Telnet) | High | Unencrypted remote access protocol |
| Port 25 (SMTP) | Low | Open mail relay risk if misconfigured |
| Port 53 (DNS) | Low | Open DNS resolver, potential amplification vector |
| Port 80 (HTTP) | Informational | Standard web port, redirect to HTTPS |
| Port 443 (HTTPS) | Informational | Standard secure web port, expected |
| Port 135 (MS-RPC) | Medium | Windows RPC, frequently exploited |
| Port 389 (LDAP) | High | Directory service exposed unencrypted |
| Port 445 (SMB) | High | Ransomware and lateral movement target |
| Port 636 (LDAPS) | Medium | Encrypted directory service still exposed |
| Port 1433 (MSSQL) | High | Database exposed to the internet |
| Port 1521 (Oracle) | High | Database exposed to the internet |
| Port 2375 (Docker) | Critical | Unauthenticated container API, full host compromise |
| Port 3306 (MySQL) | High | Database exposed to the internet |
| Port 3389 (RDP) | High | Remote desktop, common ransomware entry point |
| Port 5432 (PostgreSQL) | High | Database exposed to the internet |
| Port 5601 (Kibana) | High | Log dashboard with potential sensitive data |
| Port 5900 (VNC) | High | Remote desktop with weak authentication |
| Port 6379 (Redis) | High | Often unauthenticated, filesystem write risk |
| Port 6380 (Redis TLS) | High | TLS-wrapped but still internet-exposed |
| Port 6443 (Kubernetes API) | High | Cluster management API exposed |
| Port 7474 (Neo4j) | High | Graph database exposed to the internet |
| Port 9042 (Cassandra) | High | Database exposed, often no auth by default |
| Port 9200 (Elasticsearch) | High | Search engine with potential sensitive data |
| Port 9300 (OpenSearch) | High | Search engine transport port exposed |
| Port 11211 (Memcached) | High | No auth, DDoS amplification abuse vector |
| Port 27017 (MongoDB) | High | Database exposed to the internet |
IP Addresses
| Issue | Severity | Description |
|---|---|---|
| Inactive IP | Low | No services detected, possible stale record |
| Unresponsive Host | Low | Ports open but no HTTP response |
| IP Blocklisted | High | IP appears on threat intelligence blocklists |
Certificates
| Issue | Severity | Description |
|---|---|---|
| Expired Certificate | High | Certificate past its validity period |
| Certificate Expiring Soon | Low | Certificate will expire within 30 days |
| Hostname Mismatch | Medium | Certificate does not match the domain |
| Self-Signed Certificate | Medium | Not trusted by browsers or clients |
| Weak Certificate Key | Medium | Cryptographic key too short for modern security |
HTTP
| Issue | Severity | Description |
|---|---|---|
| HTTP 404 Error | Low | Resource not found, possible stale DNS |
| HTTP 4xx Error | Low | Client error, possible misconfiguration |
| HTTP 5xx Error | Low | Server error, service may be down |
| HTTP Error | Low | No HTTP response: connection refused, timed out or dropped |
| Authentication Required | Informational | Endpoint requires credentials |
| Weak TLS Version | Medium | Deprecated TLS 1.0 or 1.1 negotiated |
| No HTTPS Redirect | Medium | HTTP traffic not redirected to HTTPS |
DNS
| Issue | Severity | Description |
|---|---|---|
| Dangling Subdomain | High | CNAME target no longer resolves, unconfirmed takeover risk |
| CNAME Takeover | Critical | Target confirmed claimable by fingerprint, active takeover risk |
| Broken Delegation | High | Delegated nameservers do not resolve |
| Zone Not Authoritative | High | Public delegation does not point at this zone |
| Delegated Subdomain | Informational | DNS managed by external nameservers |
| Broken DNS Redirect | Low | Redirect target unreachable or erroring |
Email Authentication
| Issue | Severity | Description |
|---|---|---|
| Invalid SPF Record | Medium | SPF record has syntax errors |
| SPF Exceeds Lookup Limit | Medium | More than 10 DNS lookups in SPF |
| Overly Permissive SPF | High | +all allows any server to send as your domain |
| SPF Deprecated PTR | Low | Uses deprecated ptr mechanism |
| SPF Missing Catch-All | Medium | No terminal all mechanism |
| Missing SPF Record | Medium | Zone has MX but no SPF record |
| Invalid DKIM Record | Medium | DKIM record has errors or invalid key |
| DKIM Key Revoked | Low | Public key revoked (empty p= tag) |
| Missing DKIM Record | Low | Zone has MX but no DKIM record |
| Invalid DMARC Record | Medium | DMARC record has syntax errors |
| Missing DMARC Record | Medium | Zone has MX but no DMARC policy |
| Invalid MTA-STS Record | Low | MTA-STS record missing or malformed |
| Invalid MX Record | High | MX target does not resolve, email will bounce |
BIMI
| Issue | Severity | Description |
|---|---|---|
| BIMI Requires an Enforced DMARC Policy | Medium | BIMI record present but DMARC not enforced |
| Invalid BIMI Record | Low | BIMI record malformed or insecure |
| Invalid BIMI Logo (SVG) | Low | Logo does not meet the SVG Tiny P/S profile |
| Invalid BIMI Mark Certificate | Low | VMC/CMC invalid, expired, or mismatched |
| BIMI Logo Unreachable | Low | Logo URL could not be retrieved over HTTPS |
| BIMI Mark Certificate Unreachable | Low | Certificate URL could not be retrieved over HTTPS |
Content
| Issue | Severity | Description |
|---|---|---|
| Problematic Screenshot Content | Medium | Manually flagged page content, possible compromise or abuse |
Critical
Active security risk requiring immediate action — direct compromise or takeover possible.
| Issue | Category | Description |
|---|---|---|
| Port 2375 (Docker) | Open Ports | Unauthenticated container API, full host compromise |
| CNAME Takeover | DNS | Target confirmed claimable by fingerprint, active takeover risk |
High
Serious exposure or failed security control requiring prompt remediation.
| Issue | Category | Description |
|---|---|---|
| Port 23 (Telnet) | Open Ports | Unencrypted remote access protocol |
| Port 389 (LDAP) | Open Ports | Directory service exposed unencrypted |
| Port 445 (SMB) | Open Ports | Ransomware and lateral movement target |
| Port 1433 (MSSQL) | Open Ports | Database exposed to the internet |
| Port 1521 (Oracle) | Open Ports | Database exposed to the internet |
| Port 3306 (MySQL) | Open Ports | Database exposed to the internet |
| Port 3389 (RDP) | Open Ports | Remote desktop, common ransomware entry point |
| Port 5432 (PostgreSQL) | Open Ports | Database exposed to the internet |
| Port 5601 (Kibana) | Open Ports | Log dashboard with potential sensitive data |
| Port 5900 (VNC) | Open Ports | Remote desktop with weak authentication |
| Port 6379 (Redis) | Open Ports | Often unauthenticated, filesystem write risk |
| Port 6380 (Redis TLS) | Open Ports | TLS-wrapped but still internet-exposed |
| Port 6443 (Kubernetes API) | Open Ports | Cluster management API exposed |
| Port 7474 (Neo4j) | Open Ports | Graph database exposed to the internet |
| Port 9042 (Cassandra) | Open Ports | Database exposed, often no auth by default |
| Port 9200 (Elasticsearch) | Open Ports | Search engine with potential sensitive data |
| Port 9300 (OpenSearch) | Open Ports | Search engine transport port exposed |
| Port 11211 (Memcached) | Open Ports | No auth, DDoS amplification abuse vector |
| Port 27017 (MongoDB) | Open Ports | Database exposed to the internet |
| IP Blocklisted | IP Addresses | IP appears on threat intelligence blocklists |
| Expired Certificate | Certificates | Certificate past its validity period |
| Dangling Subdomain | DNS | CNAME target no longer resolves, unconfirmed takeover risk |
| Broken Delegation | DNS | Delegated nameservers do not resolve |
| Zone Not Authoritative | DNS | Public delegation does not point at this zone |
| Overly Permissive SPF | Email Authentication | +all allows any server to send as your domain |
| Invalid MX Record | Email Authentication | MX target does not resolve, email will bounce |
Medium
Material misconfiguration or weakened control that should be investigated.
| Issue | Category | Description |
|---|---|---|
| Port 21 (FTP) | Open Ports | FTP transmits credentials in plaintext |
| Port 22 (SSH) | Open Ports | Remote shell access exposed to the internet |
| Port 135 (MS-RPC) | Open Ports | Windows RPC, frequently exploited |
| Port 636 (LDAPS) | Open Ports | Encrypted directory service still exposed |
| Hostname Mismatch | Certificates | Certificate does not match the domain |
| Self-Signed Certificate | Certificates | Not trusted by browsers or clients |
| Weak Certificate Key | Certificates | Cryptographic key too short for modern security |
| Weak TLS Version | HTTP | Deprecated TLS 1.0 or 1.1 negotiated |
| No HTTPS Redirect | HTTP | HTTP traffic not redirected to HTTPS |
| Invalid SPF Record | Email Authentication | SPF record has syntax errors |
| SPF Exceeds Lookup Limit | Email Authentication | More than 10 DNS lookups in SPF |
| SPF Missing Catch-All | Email Authentication | No terminal all mechanism |
| Missing SPF Record | Email Authentication | Zone has MX but no SPF record |
| Invalid DKIM Record | Email Authentication | DKIM record has errors or invalid key |
| Invalid DMARC Record | Email Authentication | DMARC record has syntax errors |
| Missing DMARC Record | Email Authentication | Zone has MX but no DMARC policy |
| BIMI Requires an Enforced DMARC Policy | BIMI | BIMI record present but DMARC not enforced |
| Problematic Screenshot Content | Content | Manually flagged page content, possible compromise or abuse |
Low
Limited-impact hardening or operational issue to address when convenient.
| Issue | Category | Description |
|---|---|---|
| Port 25 (SMTP) | Open Ports | Open mail relay risk if misconfigured |
| Port 53 (DNS) | Open Ports | Open DNS resolver, potential amplification vector |
| Inactive IP | IP Addresses | No services detected, possible stale record |
| Unresponsive Host | IP Addresses | Ports open but no HTTP response |
| Certificate Expiring Soon | Certificates | Certificate will expire within 30 days |
| HTTP 404 Error | HTTP | Resource not found, possible stale DNS |
| HTTP 4xx Error | HTTP | Client error, possible misconfiguration |
| HTTP 5xx Error | HTTP | Server error, service may be down |
| HTTP Error | HTTP | No HTTP response: connection refused, timed out or dropped |
| Broken DNS Redirect | DNS | Redirect target unreachable or erroring |
| SPF Deprecated PTR | Email Authentication | Uses deprecated ptr mechanism |
| DKIM Key Revoked | Email Authentication | Public key revoked (empty p= tag) |
| Missing DKIM Record | Email Authentication | Zone has MX but no DKIM record |
| Invalid MTA-STS Record | Email Authentication | MTA-STS record missing or malformed |
| Invalid BIMI Record | BIMI | BIMI record malformed or insecure |
| Invalid BIMI Logo (SVG) | BIMI | Logo does not meet the SVG Tiny P/S profile |
| Invalid BIMI Mark Certificate | BIMI | VMC/CMC invalid, expired, or mismatched |
| BIMI Logo Unreachable | BIMI | Logo URL could not be retrieved over HTTPS |
| BIMI Mark Certificate Unreachable | BIMI | Certificate URL could not be retrieved over HTTPS |
Informational
Expected or contextual observation for awareness only.
| Issue | Category | Description |
|---|---|---|
| Port 80 (HTTP) | Open Ports | Standard web port, redirect to HTTPS |
| Port 443 (HTTPS) | Open Ports | Standard secure web port, expected |
| Authentication Required | HTTP | Endpoint requires credentials |
| Delegated Subdomain | DNS | DNS managed by external nameservers |