Front Sentinel / free tools
SEAL DNS & Registrar self-check
Preparing for the SEAL certification for DNS & Registrar? Enter a domain to see which of the 16 controls its public configuration already supports, which have gaps, and which you need to document yourself. Free, no sign-up.
What the SEAL DNS & Registrar certification is
The Security Alliance (SEAL) publishes the Security Framework and a set of certifications built on it. The DNS & Registrar certification has 16 controls in six sections: governance, risk, access control, technical standards, monitoring and incident response. Each control is a question with baseline requirements, and a team answers it with a justification and evidence.
It exists because taking over a protocol's domain is a direct path to its users' wallets: change the nameservers, serve a copy of the app with a malicious transaction, and every user who types the right address lands on it. In May 2025 an attacker got into the systems of Curve's registrar and pointed curve.fi at their own DNS. In July 2024 Squarespace reported unauthorized changes to DNS settings of several cryptocurrency domains.
What this check looks at
| Control | Public signal |
|---|---|
| dns-4.1.1 DNS Security Standards | DNSSEC signed delegation (DS at the registry) and CAA records limiting which CAs may issue certificates. |
| dns-4.1.2 Email Authentication Standards | SPF, DMARC policy and rua reporting, MTA-STS. For domains without MX: SPF -all and DMARC p=reject. DKIM selectors can't be listed from outside. |
| dns-4.1.3 Domain Lock Implementation | EPP statuses from RDAP: transfer lock and registry lock (server*Prohibited). See also the registry lock checker. |
| dns-5.1.3 Domain Expiration Prevention | Expiry date at the registry; under 90 days counts as a gap. |
| dns-2.1.2 Enterprise Registrar Security Requirements | A registry lock in place shows the registrar supports it. MFA type and incident history are for you to document. |
| dns-3.1.2 Dedicated Domain Security Contact Email | Contact lines in security.txt (RFC 9116), and whether one is on a different domain. |
The other controls are about owners, inventories, access reviews, change management and incident plans. They are real requirements, but only your own documents can show them.
Check by hand
dig +short DS example.com
dig +short CAA example.com
dig +short TXT _dmarc.example.com
curl -s https://rdap.verisign.com/com/v1/domain/example.com | jq .statusEvidence for the monitoring controls
Front Sentinel watches nameservers, DNS records, registry locks, Certificate Transparency and the scripts your frontend serves, and sends alerts to Telegram, email or webhooks. Pro adds a SEAL DNS & Registrar readiness report per domain with the change log for the last 12 months. It reads only public data and never asks for registrar access.
Monitor a domain free Pricing