Domain health

Check your domain setup: NS, DNS records, mail and DNSSEC

The report walks through your records the way browsers and mail servers do and collects the problems in one list. Every item links to a detailed check.

A tree of domain DNS records with a heartbeat line

What the report checks

The report follows the path a browser or mail server takes to find a domain: first the nameservers at the registry, then the records they serve. A mistake at any step breaks the site or the mail.

It also compares the A record at Cloudflare, Google, AliDNS and DNS.SB. If you just changed the address, the answers will differ until the old record expires by TTL.

When it helps

After moving a domain to another registrar or host.
Before launching mail on a domain: MX, SPF and DMARC in one report.
When the site opens for some people and not for others.
When you buy a domain and want to see how it is set up now.

Questions and answers

01How many nameservers does a domain need?

At least two, in different networks. Many registries require this at registration. If both servers share one network, an outage at that provider takes the domain down.

02How long does DNS propagation take?

As long as the TTL of the old record, usually from five minutes to a day. A nameserver change at the registry can take up to 48 hours.

03Do I need DNSSEC?

A signature protects DNS answers from spoofing. Turn it on if your registrar and DNS host support it. A broken signature is worse than none: the domain stops resolving.

04What is a CAA record for?

It lists the certificate authorities allowed to issue SSL for the domain. Other authorities refuse to issue. For Let’s Encrypt the record 0 issue "letsencrypt.org" is enough.

05Why does the check flag the www subdomain?

There is no record for www, so anyone who types the address with www gets an error. Add a CNAME from www to the main domain or an A record with the same IP.