Included free

Free DNS health check for your domain

DNS is the foundation your website and email sit on. Check that your records are complete, redundant and secured, with clear advice on anything missing.

Run a free audit

What it checks

Everything the dns health check looks at

A and AAAA records

Confirms your domain resolves to IPv4 and, where available, IPv6 addresses so visitors can reach your site.

Nameserver redundancy

Checks you have at least two nameservers, so your site and email stay reachable if one fails.

SOA record

Reviews the start of authority record that defines your primary nameserver and zone settings.

CAA records

Checks whether you restrict which certificate authorities may issue SSL certificates for your domain.

MX records

Confirms mail servers are published so your domain can receive email.

TXT and CNAME records

Lists TXT records such as SPF and verification tokens, and checks CNAME configuration.

DNSSEC validation

Tests DNSSEC through a validating DNS-over-HTTPS resolver to confirm your records are signed and verify correctly.

How it works

Three steps, about a minute.

1

Enter your domain

Type a domain or website address.
2

We query your DNS

Records are looked up and DNSSEC is validated through a DNS-over-HTTPS resolver.
3

Review and fix

Each finding explains the risk and the record or setting to change at your DNS provider.

Why a DNS health check matters

Every visit to your website and every email sent to your domain starts with a DNS lookup. If your DNS is misconfigured, nothing else works, however good your site is. A DNS health check confirms that the basics are in place: address records that point to your server, at least two nameservers for redundancy, a valid SOA record and mail exchanger records for email. It also checks optional but valuable protections. CAA records limit which certificate authorities can issue SSL certificates for your domain, and DNSSEC signs your records so resolvers can detect tampering. DNS makes up 10% of your overall grade in MakeItFlow, and problems here often explain issues found in the email and security sections.

Understanding DNSSEC and CAA results

DNSSEC adds digital signatures to your DNS records, allowing resolvers to confirm that answers have not been forged. Turning it on usually involves two steps: enabling signing at your DNS provider and adding a DS record at your domain registrar. If only one step is done, DNSSEC will not validate, and in some cases a broken setup can make your domain unreachable for validating resolvers. That is why we test through a validating resolver rather than simply looking for keys. CAA records are simpler: a single record naming your certificate authority, such as Let's Encrypt, tells other authorities not to issue certificates for your domain. Both are low-maintenance once configured correctly.