DNS health check

What each check means

• Nameservers — a domain needs at least two, ideally on different networks, so DNS keeps working if one goes down.
• SOA record — the zone’s start-of-authority record: primary server, admin contact, serial number and refresh/retry/expire timers.
• MX records — whether mail servers are defined and resolve to IP addresses.
• A / AAAA records — whether the domain itself resolves, so the website can load.
• CNAME at root — the DNS standard doesn’t allow a CNAME on the bare domain (it conflicts with the SOA and NS records). Use your DNS provider’s ALIAS / ANAME record or CNAME flattening instead.
• DNSSEC — signs DNS answers so they can’t be forged on the way. Optional, but recommended where your registrar and DNS host support it.

Common problems and fixes

• Only one nameserver — add a second one, or move DNS to a provider that runs several.
• MX pointing to a CNAME — not allowed (RFC 2181) and some senders will fail; point MX at a name with an A record.
• Nameservers at the registrar don’t match the zone — the list set at your registrar and the NS records inside the zone should be the same, or some lookups go to servers that no longer answer.

For SPF, DKIM, DMARC, SSL and blacklists in one scan, run the Domain trust report.