Domain DNS Health Checker
Run one comprehensive DNS health check and get a scored report covering delegation, zone consistency, web and mail records, and DNSSEC, with every finding graded pass, warning or fail.
About Domain DNS Health Checker
A domain can resolve and still be fragile in ways that only surface during an outage or a mail problem. This health checker fans out parallel queries for a domain's NS, A, AAAA, MX, CAA, SOA and DS records plus its www host, grades each area independently, and rolls the results into a single score out of 100 so you can see at a glance where a zone is solid and where it is exposed.
Delegation and zone integrity get particular attention. The report counts your name servers and warns when there is only one, since a single name server is a single point of failure. It checks whether those servers sit on different networks rather than sharing one /16, and it compares the SOA serial number reported by each authoritative server to detect a zone that is out of sync between primary and secondaries.
On the web side it verifies the apex has both an IPv4 (A) and IPv6 (AAAA) address and reports whether the www host resolves. On the mail side, when MX records are present, it runs SPF and DMARC checks inline so email authentication is assessed in the same pass rather than as an afterthought. For security it looks for a DS record in the parent zone, indicating DNSSEC is enabled, and for a CAA record that restricts which certificate authorities may issue for the domain.
Every check is queried from our EU infrastructure exactly the way any resolver on the internet would see your domain. Nothing is installed, no credentials are needed, and each finding comes with a plain-language explanation of why it matters and what to change.
How to use it
- 1Enter the domain you want to audit.
- 2Run the report; the checker issues parallel lookups for NS, A, AAAA, MX, CAA, SOA, DS and the www host.
- 3Read the results grouped by area - delegation, web, mail and security.
- 4Prioritise the failures first, then work through the warnings.
- 5Re-run after each change and watch the overall score improve.
Common use cases
- -A pre-launch or post-migration audit of a new domain's DNS
- -Periodic health monitoring of production zones
- -Catching a single-name-server or shared-network point of failure
- -Verifying DNSSEC and CAA are in place
- -Getting a fast second opinion when a domain only half works
Frequently asked questions
- What does a DNS health check test?
- It checks name-server delegation and diversity, the SOA record and serial agreement across authoritative servers, apex A/AAAA and www records, MX plus SPF and DMARC presence, and security records such as DNSSEC (DS) and CAA, then combines them into a score.
- What is a good DNS health score?
- The report grades each check as pass, warning or fail and expresses the result as a percentage. Aim for 100 with no failures; warnings flag resilience or best-practice gaps worth closing even when the domain currently resolves.
- Why is having only one name server a problem?
- A single name server is a single point of failure - if it goes offline the entire domain stops resolving. Publish at least two, ideally on different networks or providers, so the zone stays reachable during an outage.
- What does a mismatched SOA serial mean?
- If authoritative name servers report different SOA serial numbers, your zone is out of sync and a secondary has not yet pulled the latest changes. Some resolvers will serve stale records until replication catches up.
- Does the checker need access to my server?
- No. It works entirely from public DNS, querying your name servers the way any resolver on the internet would, from our EU infrastructure. Nothing is installed and no credentials are required.