Querying every nameserver directly — this takes a few seconds.
Querying every nameserver directly — this takes a few seconds.
We use Google Analytics to see which pages get used. It sets cookies and sends data to Google. Nothing on this site needs it — declining costs you nothing. Privacy
49 checks, across delegation, the nameservers themselves, mail delivery and authentication, the web endpoint, reputation and registration. Each has a stable id that is never renamed, so you can alert on specific ones through the API.
passinfowarnfailunknownThe score counts only pass, warn (half credit) and fail. info is neutral, and unknown is our gap rather than the domain’s — marking a domain down because our host blocks port 25 would be a false accusation about somebody else’s mail server.
What the registry has on file.
DNSSEC
DNSSEC lets resolvers verify that an answer really came from the zone owner rather than an attacker on the path.
delegation.dnssecDomain is delegated
The parent zone must refer resolvers somewhere for the domain to resolve at all.
delegation.existsGlue records
Glue breaks the chicken-and-egg problem of a zone's nameservers living inside the zone.
delegation.glueRegistry and zone agree on the nameservers
When the two disagree, some resolvers use one set and some the other, which produces intermittent failures that are very hard to diagnose from the outside.
delegation.ns-matchParent returns a referral
A correct parent answers with AA=0 and the NS set in the authority section, which is how resolvers walk down the tree.
delegation.parent-refersRegistry servers
Everything in this section compares what the registry has on file against what the domain's own nameservers say.
delegation.registry-respondedHow each server actually behaves.
At least two nameservers
Two or more means one server can fail without taking the domain off the air.
ns.countNameservers are independent of each other
Two nameservers in the same rack fail together. Diversity is what makes a second nameserver actually redundant rather than decorative.
ns.diversityNameserver hostnames are valid
NS records must name a host, not an address, and that host must not be a CNAME. A nameserver on a private address is unreachable from the internet.
ns.hostnamesIPv6 reachability
IPv6-only networks exist, and resolvers on them prefer nameservers they can reach directly.
ns.ipv6Nameservers are not open resolvers
An authoritative server that also answers recursive queries for strangers gets used as an amplifier in DDoS attacks, and lands on blocklists within days.
ns.open-recursionNameservers agree on the SOA serial
The serial is the zone version. When servers report different serials, at least one is serving stale data and zone transfers are failing.
ns.serial-agreementNameservers agree on the NS set
Disagreement here means resolvers can end up with different views of the zone.
ns.set-agreementNameservers respond over TCP
RFC 7766 makes TCP mandatory. Any answer too big for a UDP packet — DNSSEC, long TXT records, large MX sets — is retried over TCP, and a server that only speaks UDP silently fails those.
ns.tcpNameservers respond over UDP
UDP port 53 is how essentially every DNS query arrives.
ns.udpZone transfers are not open to the world
An open AXFR hands an attacker every hostname in the zone — including the ones you never published — for the cost of a single query.
ns.zone-transferZone metadata and timers.
Primary nameserver is listed
The MNAME names the primary — the server secondaries pull from and the target of dynamic updates.
soa.mname-listedSOA record
The SOA defines the zone: who is primary, who to contact, and the replication timers.
soa.presentContact address is well-formed
The RNAME is the published route for someone to report a problem with this zone. Nobody checks it until they urgently need it.
soa.rname-validSerial number format
The serial must increase on every change, or secondaries never pull the update.
soa.serial-formatSOA timers are sensible
These govern how fast changes reach secondaries and how long a secondary keeps serving after losing contact with the primary.
soa.timersMX records and mail servers.
MX records
MX records tell the world where to deliver mail for this domain.
mail.mx-presentReverse DNS for mail servers
Most large receivers check that a sending IP has a PTR, and that the PTR name resolves back to the same IP. Missing or mismatched reverse DNS is one of the most common causes of mail landing in spam.
mail.mx-ptrMX hosts resolve to public addresses
An MX that does not resolve, or resolves to a private address, cannot receive mail from the internet.
mail.mx-resolvesMX targets are hostnames with address records
RFC 2181 §10.3 forbids an MX target being a CNAME. Some senders follow it anyway, others reject the domain outright — so it fails for a subset of your mail.
mail.mx-targetsSMTP capabilities
The advertised capabilities show what the server supports, including size limits and AUTH.
smtp.capabilitiesSMTP connectivity
Confirms the MX records lead to something that actually speaks SMTP.
smtp.connectSTARTTLS offered
Without STARTTLS, mail crosses the internet in plain text and anyone on the path can read it.
smtp.starttlsMail server TLS certificate
Opportunistic TLS encrypts but does not authenticate. MTA-STS and DANE are what turn it into a real guarantee, and both require the certificate to match the MX hostname.
smtp.tls-certificateSPF, DKIM, DMARC and transport security.
BIMI
Informational — BIMI affects how mail is displayed, not whether it is delivered.
mailauth.bimiDKIM selectors
DKIM signs outgoing mail so receivers can verify it was not altered. Unlike SPF, it survives forwarding, which is why DMARC needs it.
mailauth.dkim-probeDMARC record
DMARC turns SPF and DKIM results into an instruction receivers actually act on.
mailauth.dmarc-presentMTA-STS
MTA-STS stops an attacker on the path from stripping STARTTLS and reading your mail.
mailauth.mta-stsSPF ends with an all-mechanism
The all-mechanism says what to do with senders not on the list.
mailauth.spf-allSPF stays within the 10-lookup limit
Past 10 lookups receivers return permerror and SPF stops working.
mailauth.spf-lookupsSPF record
SPF lists the servers permitted to send mail as this domain.
mailauth.spf-presentSPF avoids the `ptr` mechanism
`ptr` is deprecated and unreliable — some receivers ignore it outright.
mailauth.spf-ptrTLS reporting
TLS-RPT is how you find out that mail to you is failing TLS, rather than guessing.
mailauth.tls-rptAddress records and certificates.
Apex address records
The apex record is what answers when someone types the bare domain name.
web.apex-addressApex is not a CNAME
The zone apex must carry SOA and NS records, and a CNAME may not coexist with other records at the same name.
web.apex-cnameCAA records
CAA limits which certificate authorities can issue a certificate for your domain.
web.caaHTTPS certificate
Confirms visitors reach this site over HTTPS without a warning.
web.httpsWildcard records
A wildcard makes every possible subdomain resolve, which hides typos and lets anyone point a plausible-looking hostname at your infrastructure.
web.wildcardwww hostname
Many people still type www, and old links often include it.
web.wwwBlacklist status.
Blacklist status
A listed mail server has its mail rejected or spam-foldered by many receivers.
reputation.summaryRegistrar records.
Domain registration expiry
An expired domain stops resolving entirely, whatever the DNS says.
registration.expiryRegistry status
Holds and pending deletions take a domain off the internet regardless of its DNS.
registration.statusTransfer lock
The lock is what stops someone who has compromised your registrar account, or forged an authorisation, from moving the domain away before you notice.
registration.transfer-lockSomething missing, or a check you disagree with? Tell us— the reasoning behind each one is meant to be arguable.