DNS Health Report
Run a bundle of DNS checks for one domain and get an overall health score, an A–F grade, and an ordered fix plan. Checks: SPF, DMARC, DKIM, nameservers, SOA, MX, CAA, DNSSEC, and A/AAAA.
Enter a domain name and run the report to see the overall health score and grade.
What is a DNS Health Report?
A DNS Health Report runs a bundle of checks against a single domain and grades each one PASS, WARN, FAIL, or INFO. The results are aggregated into a 0–100 score and an A–F grade, with an ordered fix plan that prioritizes confirmed problems first.
What We Check
SPF
Verifies the domain has a valid SPF record and does not use the insecure +all mechanism.
DMARC
Checks for a DMARC policy at _dmarc and whether it enforces (p=quarantine/reject) or only monitors (p=none).
DKIM
Probes common selectors for a signing key. Absence of a probed selector is reported honestly, not as a failure.
Nameservers
Confirms delegation exists, there are at least two unique name servers, and none is an IP literal.
SOA
Validates the zone's start-of-authority record and flags overly long negative-caching TTLs.
MX
Confirms mail routing exists (or an explicit null-MX) and that targets resolve.
How to Use the DNS Health Report
- Enter the domain name you want to check (e.g., example.com)
- Click "Run Health Report" for a one-off check, or "Run & Save" to store it and get a shareable link
- Review the score, grade, fix plan, and per-check details
- Export as JSON, CSV, or print to PDF
Understanding the Score
Each check carries a fixed weight. PASS and INFO earn full credit, WARN earns 85%, and FAIL earns 0%. The grade bands are A+ (95–100), A (85–94), B (75–84), C (60–74), D (40–59), and F (0–39). If SPF, DMARC, or MX fails, the overall grade is capped at F because email authentication is the highest-value gate.