Audit the DNS setup of any domain and get a letter grade with specific fix hints for each failing check.
Enter a domain to run a full DNS health check
DNS health goes beyond whether a domain resolves. NS redundancy ensures your domain stays reachable if one nameserver fails - you need at least two. SPF and DMARC are email authentication records that prevent other servers from forging mail from your domain. CAA restricts which Certificate Authorities can issue TLS certificates. DNSSEC cryptographically signs DNS responses to prevent cache poisoning and spoofing.
The grading weights critical infrastructure (A record, NS) and email security (SPF, DMARC) most heavily since they directly impact availability and deliverability. AAAA and DNSSEC are recommended but not penalised as heavily.
The delegation checks compare the name servers the parent zone lists (.com for example.com) with the ones the servers of the domain list, compare the glue addresses with the addresses the zone gives, and ask every server for the zone over UDP and TCP. These lower the grade: a server that does not answer for the zone (a lame server) or does not answer at all, lists that disagree, wrong glue and no answer over TCP. These are shown as advice only: SOA serials that differ, a server that answers recursive queries for anyone (an open resolver) and all servers in one IPv4 /24 network.
Sent to our server: Domain. We look it up in DNS. Part of this work runs on our own server. To answer a repeated check fast, we have to keep answers for 5 minutes; then they are deleted. Also added to the page link, so you can share the result: Domain.