One check of nameserver redundancy and answers, DNSSEC, CAA and MX resolution, to catch misconfigurations that stop your domain resolving.
The DNS Health Check tells you whether a domain's DNS setup is sound. A single nameserver, one that does not answer, or broken DNSSEC signatures can make the domain stop resolving — and with it your website and email. Free, no sign-up.
Besides public DNS, it queries each nameserver directly to see whether it answers authoritatively (lame delegation), whether SOA serials agree and whether the parent's delegation matches. It never queries non-public IP addresses.
| Area | Main checks |
|---|---|
| Nameservers | Two or more, spread over networks, resolvable (and the NS domain not expired), answering authoritatively, responding at all, SOA serial agreement, match with the parent's delegation, IPv6 |
| DNSSEC | DS / DNSKEY consistency and validation result. A validation failure is critical |
| CAA | Whether certificate issuance is restricted to chosen CAs |
| MX | Targets resolve and are not CNAMEs (an RFC violation) |
The score is out of 100: each critical finding costs 35 points and each warning 12. Missing IPv6, CAA or DNSSEC are optional and cost nothing.
Limitations
• A one-time snapshot from this tool's vantage point. A nameserver that rate-limits or blocks certain regions or IPs may show as "no response".
• Nameservers reachable only over IPv6 cannot be probed from here and are shown as "unchecked".
• SOA serials differing between independent DNS providers is normal, so it is reported as information.
• For a subdomain, the zone that contains it (e.g. example.co.jp) is checked.
What is lame delegation?
The parent zone lists a server as authoritative for your domain, but that server does not answer authoritatively. Resolvers that hit it fail, so resolution becomes unreliable.
It says a nameserver's domain does not exist.
If the domain of a hostname listed as NS has expired or was never registered, anyone can register it and take over your domain's DNS. Remove unused NS entries at the parent zone (your registrar).
What happens when DNSSEC validation fails?
Validating resolvers such as Google Public DNS refuse to answer for a domain whose validation fails, so users cannot resolve it. Typical causes are a wrong DS record or a missed key rollover.
Is it OK to check someone else's domain?
The tool only uses public DNS and ordinary DNS queries to the domain's nameservers. Still, abusing the results is prohibited.