DOMAIN
HEALTH.
A technical inventory of a domain's public configuration. The page distinguishes a record being published from complete validation; SPF, DMARC and DNSSEC are not approved merely because they exist.
Accepts a domain, URL or email address: https://, path, port and user are stripped before the lookup.
The A–F configuration grade is based only on fail/warning counts in this diagnostic; INFO items are neutral. It is not a security certification.
Email posture inside Domain Health
MX, SPF, DMARC and TLS-RPT are summarized here. DKIM, BIMI and MTA-STS remain in the complete email workflow.
VIEW RAW DNS RECORDS
RECENT LOCAL QUERIES
Frequently asked questions
What does Domain Health check?
The public configuration of a domain: resolution (A and AAAA), name servers, MX, SPF, DMARC, DNSSEC and CAA. It separates a record that exists from a configuration that is validated.
Why are SPF and DMARC shown as info rather than passed?
Because existing is not enough. An SPF record can be published and still exceed the lookup limit, and DMARC with p=none blocks nothing. The panel shows what was found and what is left to check.
Do I need DNSSEC?
It is optional but protects against forged DNS answers. It only works with a DS record published at the registry and a signed zone at your DNS provider.
What is a CAA record for?
It lists the certificate authorities allowed to issue certificates for the domain. Without CAA any authority may issue; with it, requests from others are refused.
I changed my DNS and the result did not change. Why?
DNS answers are cached for the record TTL. Public resolvers may keep the old answer until it expires.