DNS Health Check

Free DNS health check. One domain, one report: A, AAAA, MX, NS, TXT, SOA, CAA records plus plain-English findings on reachability, email, and security.

What is a DNS health check?

A DNS health check queries every common record type for a domain at once and summarizes what's configured and what's missing. Instead of looking up one record type at a time, you get a single report card covering A, AAAA, MX, NS, TXT, SOA, and CAA records, plus plain-English findings.

What the report checks

• Reachability — does the domain resolve to an IPv4 (A) and/or IPv6 (AAAA) address?
• Email — are there MX records, and is an SPF policy published in TXT?
• Delegation — which nameservers are authoritative (NS)?
• Zone authority — the SOA record and its serial/timers.
• Certificate security — is a CAA record restricting which CAs may issue certs?

Reading the findings

Each finding is marked good (✓), warning (!), or info (·). A warning isn't always a problem — for example, "no AAAA record" just means the domain is IPv4-only. The report uses a single fast resolver (Cloudflare) for breadth; to confirm a record has propagated worldwide, run the propagation checker which queries 14 resolvers.

FAQ

How is this different from the propagation checker?

The health check queries all record types against one resolver, for breadth. The propagation checker queries one record type against 14 resolvers, to confirm a change has spread worldwide. Use health check for "is my DNS set up correctly?" and propagation for "has my change gone live everywhere?".

Why does it say I have no SPF record?

SPF is published as a TXT record starting with v=spf1. If you have MX records (you receive email) but no SPF, your outbound mail is more likely to be flagged as spam. See the SPF glossary entry.

Is "no CAA record" a problem?

Not necessarily, but it's a missed security opportunity. Without a CAA record, any certificate authority can issue a TLS certificate for your domain. Adding one restricts issuance to CAs you trust.

Does the health check show propagation status?

No — it's a single-resolver snapshot. For propagation across regions, use the main propagation checker.

Background reading

See the DNS Records Explained guide and the DNS glossary.