Why does "DNS posture metadata / inconclusive notes" appear in ExposureGrid?

Scanners observe externally visible signals. A finding means our rules matched - validate severity and applicability in your environment.

Could this be a false positive?

Yes, depending on context and coverage limits. Especially for heuristic, partial, or pattern-based checks, corroborate with manual review.

What should I do after changing configuration?

Re-run a scan to confirm the external signal changed, then enable monitoring where your plan supports it.

DNS posture metadata / inconclusive notes

Scan your domain

DNS posture metadata / inconclusive notes: what it means, why it may matter, and how to remediate with external verification using ExposureGrid.

The problem

DNS posture metadata / inconclusive notes: DNS records define how the internet routes users and mail for your domain. Misconfigurations can create takeover, mail, or certificate issuance risks.

Why it matters

DNS issues may be informational or materially risky depending on record type and environment - validate before assuming exploitation.

How to check

Review authoritative DNS, trace CNAME chains, inspect CAA, MX, and delegation health. ExposureGrid summarizes externally visible posture.

How to fix

Remove stale records, fix dangling targets, publish intentional CAA, align apex/www consistency, validate MX ownership, document changes.

Identify owners for the affected component (app, edge, DNS, or mail).
Make a minimal change and validate in staging or a canary route.
Deploy with monitoring and rollback readiness.
Re-run ExposureGrid to confirm the external signal improved.

Run a scan to verify this fix on your domain

Use the same public scanner as the homepage — results honor your plan tier.

Scan your domain

What ExposureGrid checks

ExposureGrid runs external DNS probes aligned with managed scan tiers.

FAQ

Why does "DNS posture metadata / inconclusive notes" appear in ExposureGrid?: Scanners observe externally visible signals. A finding means our rules matched - validate severity and applicability in your environment.
Could this be a false positive?: Yes, depending on context and coverage limits. Especially for heuristic, partial, or pattern-based checks, corroborate with manual review.
What should I do after changing configuration?: Re-run a scan to confirm the external signal changed, then enable monitoring where your plan supports it.

ExposureGrid continuously monitors these issues and alerts you before they become exploitable.

Start monitoring your domain Scan your domain

Run a private scan

Compare plans

Start free scan Compare plans