Domain DNS Health Checker

Run a full DNS & email configuration audit for any domain in one click.

What is a DNS health checker?

A DNS health checker runs a quick audit of the DNS settings a domain needs for its website and email to work. This one tests six things in one pass: nameservers, address records, MX records, SPF, DMARC and the SOA record. Each test is shown as Pass or Issue with a short explanation, and the results are combined into a percentage score.

It is designed as a fast first check after any DNS change, or whenever a site or email starts behaving strangely.

How the DNS health check works

The checker looks up the domain's NS, A, AAAA, MX, TXT and SOA records, plus the TXT record at _dmarc under the domain. It then applies six simple rules. Each rule has the same weight, so the score is the share of checks that passed: six out of six is 100%, five out of six is 83%, and so on.

The six DNS health checks

  • Nameservers: passes with two or more NS records.
  • A / AAAA: passes when the domain has at least one IPv4 or IPv6 address.
  • MX: passes when at least one mail server is listed.
  • SPF: passes when a TXT record starts with v=spf1.
  • DMARC: passes when a record starting with v=DMARC1 is published at _dmarc.
  • SOA: passes when the zone returns a start-of-authority record.

How to use the DNS health checker

  1. Enter the domain, for example example.com.
  2. Press Check DNS Health.
  3. Look at the score: green from 80%, amber from 50%, red below that.
  4. Read each check marked Issue and fix it at your DNS provider, then run the check again.

Reading your DNS health score

A perfect score means all six basics are in place. It does not prove every record is correct. For example, the SPF check confirms an SPF record exists, while the SPF Checker goes further and validates its syntax and lookup count. Treat this tool as a checklist that points you to the right detailed tool.

Some issues are deliberate. A domain used only for a website may have no MX record on purpose. Even then, publishing SPF and DMARC records that say the domain sends no email is good practice, because it stops others from sending email that pretends to come from it.

What this DNS health check does not cover

The checker deliberately stays small. It does not test DKIM, because DKIM keys are published under a selector name that is different for every email provider; use the DKIM Checker with your selector instead. It does not test DNSSEC, the website's response or the SSL certificate, which the Domain Health Check covers. And it checks that records exist, not that each value is correct.

Common uses

  • A quick check after moving a domain to a new DNS provider.
  • Making sure email security basics exist before sending a newsletter.
  • Reviewing a client's domain at the start of a project.
  • Re-checking email records after an IT or marketing tool was added to the domain.

Common problems and fixes

Nameservers issue. Only one nameserver is set. Add the second nameserver your DNS provider supplies.

SPF issue. Publish one TXT record starting with v=spf1 that lists your email senders. Do not publish two separate SPF records; merge them into one.

DMARC issue. Add a TXT record at _dmarc.yourdomain. A monitoring policy such as v=DMARC1; p=none is a safe first step.

Still failing after a fix. The old answer may be cached. Check again after the record's TTL has passed.

Related tools

Frequently asked questions

What does the DNS health checker test?

It runs six checks: at least two nameservers, an A or AAAA record, at least one MX record, an SPF record, a DMARC record and an SOA record. Each passed check is worth an equal share of the score, so the percentage shows how many of the six basics are in place.

Is 100% a guarantee that my DNS is correct?

No. A full score means the six basic records exist, not that every value inside them is right. An SPF record can exist but contain a mistake, for example. Use the DNS Lookup, SPF Checker and DMARC Checker to review the actual values in detail.

Why does my score drop if I do not use email?

The checker includes MX, SPF and DMARC because most domains send or receive email. If yours never does, the missing MX record can be ignored. Publishing a strict SPF record of v=spf1 -all and a DMARC record is still recommended, because it stops others spoofing the domain.

How is this different from the Domain Health Check?

The DNS health checker focuses on six DNS and email records and gives an equally weighted percentage. The Domain Health Check is broader: it adds registration, expiry, DNSSEC, website response and SSL, and uses weighted points. Use this tool for DNS problems and the other for an overall picture.

Why does the SOA check matter?

The SOA, or start of authority, record is the core record of a DNS zone. It names the primary nameserver and sets timers that other servers use. A missing SOA usually means the zone is not set up correctly at the DNS provider, which can affect every other record.

How often should I run a DNS health check?

Run it after any change to DNS, hosting or email providers, and periodically for important domains, for example once a month. DNS records are often edited by several people or tools over time, and a regular check catches a deleted SPF or DMARC record before it affects email delivery.

I fixed an issue but the checker still fails. Why?

The old answer may still be cached by the resolver we query until the record's TTL runs out. Wait a while and run the check again. If it still fails, confirm the record was saved at the DNS provider that your nameservers actually point to.