What is checked?
- A, AAAA, CNAME, MX, NS, SOA, TXT and CAA records
- SPF, DKIM, DMARC, MTA-STS and BIMI
- DNSSEC chain of trust and signature validation
- Nameserver count, ASN diversity, response time and SOA serial consistency
- Propagation across 12 open resolvers
- SSL certificate and HTTP security headers
How do I read the result?
- The score runs from 0 to 100; an error costs full points, a warning half.
- Things to fix are listed by severity; each finding has ready-to-paste record text and a copy button.
- Resolvers returning an old value update when the TTL expires.
Frequently asked questions
Do results come from a cache?
No. Records are asked of the domain's authoritative server. Open resolvers are only used for the propagation comparison. Section results are kept for 60 seconds to reduce load.
Which domains are supported?
All public extensions and IDN domain names. Private or local names are not queried.