DNS health checker
Read a domain’s DNS from public resolvers: its name servers and SOA, its addresses, CAA, and every record its mail depends on, with what is wrong with each in words.
What does it check?
No rule in the rulebook covers this, so here is what it reads.
- The name servers, and whether each answers
- The SOA record and its timings
- The addresses the name points to, IPv4 and IPv6
- CAA, which says who may issue its certificates
- Every record its mail depends on
| Name | Type | Value |
|---|---|---|
| @ | NS | ns1.dns-one.example. |
| @ | NS | ns2.dns-two.example. |
| @ | SOA | ns1.dns-one.example. hostmaster.example.com. 2026102301 7200 3600 1209600 3600 |
| @ | A | 203.0.113.10 |
| @ | AAAA | 2001:db8::10 |
| @ | CAA | 0 issue "letsencrypt.org" |
| @ | MX | 10 mail.example.com. |
| @ | TXT | "v=spf1 mx -all" |
| _dmarc | TXT | "v=DMARC1; p=reject; rua=mailto:[email protected]" |
Two name servers on separate networks, an address for IPv4 and IPv6, CAA naming the one authority that may issue, and every record its mail needs.
Questions
How long do DNS changes take?
As long as each record’s TTL. Resolvers keep an answer that long before asking again.
How many name servers should a domain have?
At least two, on separate networks, so the domain still answers when one is down.
What is a CAA record?
A record that names the certificate authorities allowed to issue certificates for the domain.
The whole site
One page is one part. A read checks every page against the whole rulebook and says what to fix first.
Read a whole site