DNS Health Check
Run a comprehensive DNS health check on your domain. Analyze nameservers, SOA, MX, web records, and email authentication.
What we check
Nameservers
NS records exist, at least 2 servers, all resolve to IPs, no CNAME targets, servers on different subnets, and each server actually answers queries and is authoritative for the zone.
SOA Record
SOA record exists, serial number, refresh, retry, expire, and minimum TTL validated against RFC 1912 recommendations.
Mail (MX)
MX records exist, all targets resolve, hostnames (not IPs), no CNAME pointing, unique priorities.
Web (A/AAAA)
A/AAAA records for the domain, IPv6 support, www subdomain resolves, www and apex consistency.
Email Authentication
SPF record exists and is valid (single record, has 'all' mechanism), DMARC record exists with enforcement policy.
Health Check Results
Health Score
Other DNS Tools
DNS Lookup
Query DNS records for any domain. Check A, AAAA, MX, CNAME, TXT, NS, SOA, SRV, CAA, and PTR records.
DNS Propagation Checker
Check if DNS changes have propagated across global DNS servers. Verify updates from Google, Cloudflare, OpenDNS, and more.
SPF / DKIM / DMARC
Generate SPF and DMARC records and validate SPF, DKIM, and DMARC. Improve email deliverability and protect against spoofing.
WHOIS Lookup
Look up domain registration information. Find registrar, creation date, expiry date, nameservers, and contact details.
SSL Certificate Checker
Inspect SSL/TLS certificates. Check issuer, validity dates, subject alternative names, and certificate chain.
Blacklist Check
Check if an IP address or domain is listed on DNS-based blacklists (DNSBL). Test against Spamhaus, Barracuda, SpamCop, and more.
Frequently Asked Questions
-
It runs over 20 checks across 5 categories: nameservers (NS records, redundancy, subnet diversity), SOA record (serial, refresh, retry, expire, minimum TTL per RFC standards), mail configuration (MX records, resolution, CNAME issues), web records (A/AAAA, IPv6, www), and email authentication (SPF, DMARC).
-
A score of 80+ indicates a well-configured domain. Scores between 60-80 suggest some improvements are needed. Below 60 means there are significant issues that should be addressed. The score is weighted across all categories.
-
Warnings indicate best-practice recommendations that aren’t strictly required. For example, missing IPv6 (AAAA) records or a DMARC policy set to 'none' won’t break anything but could be improved. Failures indicate issues that violate RFC standards or could cause real problems.
-
RFC 1912 recommends: refresh 1200-43200s, retry 120-7200s (less than refresh), expire 604800-4838400s (1-8 weeks), and minimum TTL 60-86400s. The serial should be a positive number, ideally in YYYYMMDDNN format.
-
RFC 2182 requires at least two nameservers for redundancy. If one server goes down, the other continues to answer DNS queries. Ideally, nameservers should be on different networks (/24 subnets) to survive network-level failures.