What the report checks
Six groups of tests, each one explained in plain terms with the setting that caused it.
Parent & delegation
Whether the domain is delegated at all, how many nameservers answer, the NS record TTL, and whether the zone is signed with DNSSEC.
Nameservers
Every nameserver resolves to an address, none use private IPs, and they sit in different networks instead of one rack.
SOA record
Primary server, zone contact, serial format, and the refresh, retry, expire and negative-cache timers against RFC 1912 ranges.
MX & mail
Mail exchangers and priorities, whether each host resolves, duplicates, private addresses, and reverse DNS on the primary.
WWW records
Address records for the apex and for www, IPv6 availability, and TTLs that are too short to be useful or too long to change safely.
SPF, DMARC, CAA
Exactly one SPF record with a strict ending, a DMARC policy at _dmarc, and CAA records limiting who may issue certificates.
Help
- Where do the answers come from?
- Your browser queries public DNS-over-HTTPS resolvers directly — Google first, Cloudflare if that fails. Nothing you type is sent to our servers or logged.
- I changed a record and the report still shows the old one.
- Answers come from resolver cache. Check the TTL column under Raw records: a record with a TTL of 3600 can stay cached for a full hour after you change it at the registrar.
- What is the difference between a warning and an error?
- An error means something is broken right now — mail will bounce or the site will not resolve. A warning means it works today but breaks under load, during an outage, or on your next change.