🏥 DNS Health Check

What a Domain Health Check Covers

The DNS health check scans a domain's DNS and email-security records, checks its IP against major blacklists, and grades the result so you can see what's missing or misconfigured at a glance.

What We Check

• DNS Records: A, AAAA, MX, NS, SOA, and CAA records
• Email Security: SPF, DKIM selector hints, DMARC, MTA-STS, TLS-RPT, and BIMI
• Blacklist Status: Quick check of the domain's IP against 10 major email blacklists

Scoring

• A+ (90-100): Excellent — All critical configurations in place
• A (80-89): Good — Minor improvements possible
• B (70-79): Fair — Some important configurations missing
• C (60-69): Needs Work — Multiple issues to address
• D/F (below 60): Poor — Critical security gaps

If a blacklist couldn't be queried (some lists, including Spamhaus, refuse lookups from shared cloud DNS resolvers), it's left out of the score rather than counted against you.

How to Fix the Most Common Health Check Failures

• No SPF record, or more than one: publish a single SPF TXT record that lists every service sending your mail. Build one with the SPF Generator.
• No DMARC record, or p=none: start with p=none and a report address, then move to quarantine or reject once the reports look clean. Create the record with the DMARC Generator.
• SPF ends in +all (or a bare all): this authorizes every server on the internet to send as your domain. Replace it with ~all while you check your senders, then -all. Build a corrected record with the SPF Generator.
• SPF ends in ~all or ?all: once you're sure every sender is listed, switch to -all. Check the record with the SPF Validator.
• No MX record: the domain can't receive email. If it should, add the MX records from your email provider and confirm them with the MX Lookup.
• No CAA record: any certificate authority may issue certificates for the domain. Restrict that with a CAA record; see the CAA Checker.
• MTA-STS or TLS-RPT not configured: these enforce, and report on, encrypted delivery of your incoming mail. See the MTA-STS Checker and TLS-RPT Checker.
• Listed on a blacklist: run a full blacklist check to see every list, the reason code and how to request removal.

Frequently Asked Questions

What is a DNS health check?

A scan of a domain's DNS and email-security records (A, AAAA, MX, NS, SOA, CAA, SPF, DMARC, MTA-STS, TLS-RPT and BIMI, plus DKIM selector hints) and a blacklist check of the domain's IP, graded into one score so you can see what's missing or misconfigured.

How do I check my domain's health?

Enter the domain above and run the check. You get a grade from A+ to F, a score for each category, and a list of issues and recommendations, each with what it means and which tool fixes it.

What does my health score mean?

A+ (90–100): all critical records in place. A (80–89): minor improvements possible. B (70–79): some important records missing. C (60–69): several issues. Below 60: critical gaps, usually a missing SPF or DMARC record or a blacklist listing.

How often should I run a DNS health check?

After any DNS or email change (a new email provider, a migration, a new sending service), and about monthly otherwise. Records drift as services are added and retired.

Why does the blacklist check say some lists couldn't be queried?

Some blocklists, including Spamhaus, refuse lookups that come through shared cloud DNS resolvers and answer with an error code instead. That isn't a listing, so the health check leaves those lists out of the score. The Blacklist Checker links to each list's own lookup page.