About Inspect My DNS

A single diagnostic report for a domain name: a full DNS health audit, who runs your DNS, email and hosting, and what your registrar has on file. It exists because that information is normally spread across four different tools, and because the most useful question — “where does this domain actually live?” — is not one any of them answers directly.

There are 50 checks. Every one has a stable identifier, a plain-language summary, the raw evidence that produced it, and a sentence explaining why it matters. See what we check.

Most tools ask a recursive resolver and report what comes back. That is fine for looking a record up, and useless for auditing: the resolver hands you one merged, cached answer with no indication of which server said it, whether that server claimed authority, or whether your nameservers disagree with each other. Those are precisely the signals a delegation audit is made of.

So findings are gathered by querying each of your nameservers directly, with recursion disabled, and comparing the answers. Supporting data that is not a finding about your domain — reverse DNS on somebody else’s address, which network an IP belongs to, blacklist lookups — goes through our own resolver, where a cached answer is fine and often better.

Where a piece of data came from a cache, the report says so rather than implying it is live.

Checks are pass, info, warning, failed — and not measured.

That last one matters. Some probes fail for reasons that say nothing about your domain: outbound port 25 is blocked by most hosting providers by default, so the SMTP probe often cannot connect at all. Reporting that as a failure would be an accusation against a mail server that is working perfectly well. It is reported as unmeasured, and it does not affect the score.

The same rule covers reachability. If the network this runs on has no route to one of your nameservers — an IPv6-only server seen from a host without IPv6, say — that address is reported as untested rather than unreachable, and the rest of the check is graded on the addresses we could actually reach. A limitation at our end is never counted against you.

Colour is never the only signal — every severity is shown as an icon and a word as well, so the report works in greyscale, with colour vision deficiency, and read aloud.

• No mailbox validation. The SMTP probe reads the greeting and the capability list, then disconnects. It never sends MAIL FROM or RCPT TO — address-verification traffic is indistinguishable from a dictionary attack at the receiving end, and rightly gets the sender blacklisted.
• No port scanning. Only 25, 80 and 443, only against hosts your own DNS records point at.
• No connections to private networks. Every outbound target is checked against the loopback, private, link-local, CGNAT and reserved ranges first — in both address families — and re-checked after every redirect.
• No paid or key-requiring third-party APIs. Everything here runs on DNS, RDAP, WHOIS and published range files.

Scan history is public for any domain that has been scanned. Anyone can see that a domain’s nameservers moved to Cloudflare in March or that its mail moved from Google to Microsoft in June. That is the feature people come back for, and it is also information some domain owners would rather not publish.

The scan form has a “don’t list this result publicly” option, which keeps that report off the home page and out of search results. It is worth being precise about what it does not do: the report stays readable by anyone with the link, and it remains in the domain’s history. It stops us advertising a result, and nothing more. If you want a domain gone rather than quiet, the opt-out below is the right tool.

If you would prefer a domain’s history not be public, email contact@inspectmydns.com and it will be removed. No justification needed, and we will not ask for one. Full privacy notice

A scan is considered fresh for five minutes, and the age of what you are looking at is always shown. You can force a fresh check three times per domain per fifteen minutes — enough to watch a change propagate, not enough to use this as a load generator against someone’s nameservers.

Checking many different domains is normal and is not throttled. The limit is per domain.

The same data is available as JSON, free and without a key at the same limits the website gets. The OpenAPI description covers every endpoint, and /keys issues a key if you need a higher ceiling.