DNS Health Check
Review your DNS configuration and identify findings that need attention.
Understand your DNS configuration.
Run a check to view findings and practical guidance.
- DNS basics A, AAAA and SOA records returned for the domain.
- Email configuration MX, SPF and DMARC.
- Nameservers NS records reported for the domain.
- Optional hardening CAA and observed TTL. These notes are optional.
Know what the report means.
The score summarizes applicable checks that finished. Review each finding before changing DNS. MX names a mail host. SPF is one TXT policy for senders. DMARC is a TXT record at _dmarc. p=none is a valid monitoring policy. Missing CAA and missing IPv6 are optional notes.
Results reflect the checks performed and do not guarantee the security or availability of a domain.
How is the score calculated?
The score uses only applicable checks that finished. It starts at 100. Documented penalties: 40 when a completed NS query has no names or returns NXDOMAIN, 8 when one NS name is returned, 15 when a completed address check has neither A nor AAAA, 12 when email use is yes and MX is missing, 12 for a Null MX when email use is yes, 8 when a published MX target has no address, 12 when email use is yes and SPF is missing, 15 for multiple SPF records, 10 for an SPF syntax or loop problem, 8 when a finished SPF walk exceeds 10 DNS lookups, 10 when email use is yes and DMARC is missing, and 10 for an invalid or duplicate DMARC record. DMARC p=none, absent CAA, absent IPv6, and observed TTL do not reduce the score. DNSSEC is not checked and is not part of the score. If an important check fails or is not performed, the report says Incomplete assessment and shows coverage instead of a score. A finished score of 80 or above is marked good, 40 to 79 needs attention, and below 40 is critical.
What do severity levels mean?
Critical is used when the queried name or its NS answer is NXDOMAIN, or when a completed NS query returns no names. Warning covers one NS name, no address at the queried hostname, mail problems when email use is yes, and broken SPF or DMARC records. Info covers monitoring choices such as DMARC p=none, optional CAA, SOA not seen in the resolver answer, and TTL values observed from the resolver. Those info items are not scored. An unfinished check stays unfinished. It is not shown as a pass and it is not turned into a missing record.
Are all recommendations required?
No. Critical and warning findings are the completed checks that affect operation. Info notes, including DMARC p=none and absent CAA, are optional and are not scored. Example records are text to adapt. This page does not change DNS.