Check a domain's DNS health
Every query goes straight to the authoritative servers, starting at the root, exactly the way a resolver sees your domain. No third-party resolvers involved.
Your recent checks saved in this browser only
What gets checked
Around 28-plus individual checks, grouped the way a resolver walks your domain.
Parent
The delegation from the registry: does the parent zone hand your domain to the right nameservers, with glue where it is needed?
- Delegation found
- Domain NS records at parent
- Parent sent glue
- Nameservers have addresses
NS
The nameservers themselves: reachable, consistent with each other, spread across networks, and not answering questions they should not.
- NS records at your nameservers
- Nameserver names are valid hostnames
- Number of nameservers
- All nameservers responded
- Lame nameservers
SOA
The start-of-authority record: serial numbers agreeing across every server, and the refresh/retry/expire timers within sane ranges.
- SOA record
- Serial numbers agree
- SOA primary is a listed nameserver
- Serial number format
- SOA refresh
MX
Mail routing: valid mail hosts that resolve to public addresses, with no CNAMEs and with reverse DNS.
- MX records
- MX sets agree across your nameservers
- MX targets are valid hostnames
- MX targets are not CNAMEs
- MX targets resolve to public addresses
Mail policy records, SPF and DMARC, so receivers can tell your real mail from forgeries.
- SPF record
- DMARC record
WWW
The web addresses: the apex and www both resolve, and any CNAME is followed to its target.
- www address records
- Domain (apex) address records
- www CNAME target
CAA
Which certificate authorities are allowed to issue TLS certificates for your domain.
- CAA records
DNSSEC
The signing chain: a DS record at the parent, a DNSKEY at the child, and a valid signature on the SOA.
- DS record at parent
- DNSKEY at child
- Zone data is signed (RRSIG)
How it works
-
Start at the root
We load the bundled root hints and ask a root server which nameservers run your TLD, then walk down, TLD to registry to your domain, following each delegation.
-
Ask the authoritative servers directly
For every check we query the nameservers actually responsible for your zone, in parallel, over UDP and TCP. No third-party resolver ever sees the query, so nothing is hidden behind a cache.
-
Report what each server said
We compare answers server by server: matching serials, consistent NS and MX sets, working glue, mail policy, DNSSEC. Every finding names the server, and cites the RFC where one applies.
Questions
Is it free?
Yes. Every report is free, with no ads. There are gentle per-minute rate limits so the service stays healthy for everyone.
Do I need an account?
No. You can run reports freely without signing in, and you will never be required to. Accounts are coming soon; signing in will give you higher rate limits, but running a report will always be available without one.
Why do the results differ from other DNS checkers?
This tool does not use a recursive resolver like 8.8.8.8 or 1.1.1.1. It starts at the root, walks the delegation, and asks each authoritative nameserver directly, so it can show which server gave which answer and where the parent and child disagree. Tools that ask a public resolver see only the cached, merged view.
What does Fresh mean, versus a cached report?
A Fresh report was just run against the authoritative servers. To stay fast and gentle on those servers, a report is reused for a short time; a reused one is labelled Cached with its age. Use Pull a fresh report to force a new run.
What is the difference between a live link and a snapshot?
A live link always shows the current results for a domain, re-run as needed. A snapshot saves the exact results you are looking at under a permanent link, so you can share what you saw even after DNS changes.
Do you store the domains I check?
A report is cached briefly, and a request log records the domain, a timestamp, and coarse result counts for abuse prevention and statistics. Snapshots you choose to save are kept until they expire. See the privacy policy for details.
Are there rate limits?
Yes, a few reports per minute per visitor and per domain, so the tool stays responsive and does not hammer authoritative servers. Cached reports do not count against the limit. Signing in (coming soon) will raise these limits.