WHOISDomain Health Check
Overall technical domain health — a transparent, weighted score covering registration, DNS, DNSSEC, nameservers, SSL, and email configuration together.
What is a domain health check?
A domain health check measures how well a domain is set up technically and turns the result into a single score from 0 to 100. It looks at the registration, DNS, DNSSEC, nameservers, website, SSL certificate and email authentication together, because a problem in any one of them can take a site or its email offline.
This is not an SEO or marketing score. Every point comes from a real lookup, and the full scoring table is published below so you can see exactly why a domain scored the way it did.
How the domain health score works
The score is built from nine weighted checks. Each check passes or fails based on a clear rule, and passing checks earn their full weight.
| Check | Weight | Passes when |
|---|---|---|
| Registration | 15 | Registration data is retrieved |
| Domain expiry | 15 | More than 7 days remain |
| DNS | 15 | The domain resolves to at least one record |
| DNSSEC | 10 | The registry reports DNSSEC as enabled |
| Nameservers | 10 | At least two nameservers are set |
| Website | 10 | The site returns a healthy status code |
| SSL | 15 | A trusted, matching, unexpired certificate is served |
| SPF | 5 | One valid SPF record exists |
| DMARC | 5 | A DMARC record exists with no detected problems |
Unknown is not the same as failing
Some checks cannot always be evaluated; for example, DNSSEC status cannot be confirmed for an extension without RDAP. An unknown check is removed from both the points available and the points earned, so a domain that passes everything that could be checked still scores 100.
How to run a domain health check
- Enter the domain, such as
example.com, without a protocol or path. - Start the check and allow a few seconds for all nine lookups to finish.
- Read the overall score and category at the top.
- Go through the table of checks and fix any that failed, starting with the heaviest ones.
What the health score categories mean
- Excellent (90 to 100): the domain is set up well on everything that could be checked.
- Good (75 to 89): minor gaps, usually DNSSEC or email records.
- Needs attention (50 to 74): one or more important checks failed.
- Critical (0 to 49): serious problems such as no DNS, an invalid certificate or a lapsing registration.
- Unknown: nothing could be evaluated at all.
How often to run a domain health check
Run a check after any change to DNS, hosting, certificates or email, and at least once a month for domains that matter to you. SSL certificates are often renewed automatically every few months, and a failed renewal is one of the most common reasons a score suddenly drops. Regular checks also give early warning of a registration nearing its end, well before the expiry check fails at seven days.
Common uses
- A quick health snapshot of your own domain after changes.
- Checking a client's domain at the start of a project.
- Spotting a soon-expiring domain or an expired certificate before visitors do.
- Comparing the score before and after a hosting or DNS move.
Common problems and fixes
SSL failed. The certificate is expired, untrusted or issued for another name. Renew or reissue it through your host or certificate provider.
Nameservers failed. Only one nameserver is listed. Add a second at your DNS provider for redundancy.
SPF or DMARC failed. Publish one SPF TXT record listing your mail senders, and add a DMARC record starting with v=DMARC1.
Related tools
- Complete Domain Report shows the full detail behind each check.
- Domain DNS Health Checker audits DNS and email records in depth.
- SSL Checker explains certificate problems.
- Domain Risk Check lists technical risk signals instead of a score.
Frequently asked questions
What does a domain health check test?
It runs nine weighted checks: whether registration data can be read, whether more than seven days remain before expiry, whether DNS resolves, DNSSEC, at least two nameservers, a healthy website response, a valid SSL certificate, a single valid SPF record and a DMARC record. The results add up to a score from 0 to 100.
What is a good domain health score?
A score of 90 or above is rated Excellent and 75 to 89 is Good. Between 50 and 74 means some important checks failed, and below 50 is Critical. Because unknown checks are left out of the calculation, a high score always reflects checks that were actually passed.
Why did my domain lose points for DNSSEC?
DNSSEC adds cryptographic signatures to DNS answers, and the registry did not report it as enabled for your domain. Many legitimate domains do not use DNSSEC, so the weight is moderate. If your DNS provider and registrar support it, turning it on usually takes a few clicks.
Is the domain health check an SEO score?
No. It measures technical setup only: registration, DNS, nameservers, website response, SSL and email authentication. It does not look at content, keywords, backlinks or rankings. A technically healthy domain helps visitors and search engines reach your site reliably, but it still needs useful content to perform well in search.
What does Unknown mean in the results?
It means a check could not be evaluated, for example because the registry does not publish DNSSEC information or a lookup did not complete. Unknown checks are removed from the score entirely rather than counted as failures, so they never pull your score down.
Why does the expiry check fail with only a week left?
The expiry check passes while more than seven days remain before the registration runs out. With seven days or fewer, the domain is at real risk of lapsing, which would take the website and email offline. Renew it at your registrar and consider turning on auto-renew.
How can I improve my domain health score?
Fix the failed checks with the highest weight first: registration, expiry, DNS and SSL are worth 15 points each. Then add a second nameserver, enable DNSSEC if available, and publish valid SPF and DMARC records. Run the check again to confirm each fix.