DNS Security Vulnerability Assessment

async function dnsSecurityScan(domain) {
  const headers = { 'Authorization': 'Bearer YOUR_API_KEY' };

  const [zoneTransfer, rebinding, wildcard, dnssec, caa] = await Promise.all([
    fetch(`https://api.edgedns.dev/v1/dns/zone-transfer?domain=${domain}`, { headers }),
    fetch(`https://api.edgedns.dev/v1/dns/rebinding?domain=${domain}`, { headers }),
    fetch(`https://api.edgedns.dev/v1/dns/wildcard?domain=${domain}`, { headers }),
    fetch(`https://api.edgedns.dev/v1/dns/dnssec?domain=${domain}`, { headers }),
    fetch(`https://api.edgedns.dev/v1/dns/caa?domain=${domain}`, { headers }),
  ].map(p => p.then(r => r.json())));

  const findings = [];

  if (zoneTransfer.data.is_vulnerable) {
    findings.push({
      severity: 'critical',
      finding: 'Zone transfer allowed - full DNS zone exposed',
      remediation: 'Restrict AXFR to authorized secondary nameservers only'
    });
  }

  if (rebinding.data.is_vulnerable) {
    findings.push({
      severity: 'high',
      finding: 'DNS rebinding vulnerability detected',
      remediation: 'Implement DNS pinning and validate Host headers'
    });
  }

  if (wildcard.data.has_wildcard) {
    findings.push({
      severity: 'medium',
      finding: 'Wildcard DNS record detected - may mask subdomain takeover',
      remediation: 'Review wildcard necessity and monitor subdomain claims'
    });
  }

  if (!dnssec.data.has_dnssec) {
    findings.push({
      severity: 'medium',
      finding: 'DNSSEC not enabled - vulnerable to cache poisoning',
      remediation: 'Enable DNSSEC signing at your DNS provider'
    });
  }

  if (!caa.data.records || caa.data.records.length === 0) {
    findings.push({
      severity: 'low',
      finding: 'No CAA records - any CA can issue certificates',
      remediation: 'Add CAA records to restrict certificate issuance'
    });
  }

  return { domain, findings, riskLevel: findings.some(f => f.severity === 'critical') ? 'critical' : 'moderate' };
}