Free tool · DNS
DNS health checker
Validate DNSSEC, audit CAA records, surface registration expiry, and sweep the major mail blacklists in one shot. No signup.
What this tool checks
We resolve every relevant DNS record type for the domain (NS, MX, A/AAAA, CAA, DNSSEC chain), then probe registration expiry via RDAP and check the resolved mail IPs against six major mail blocklists chosen for low false-positive rate and high signal weight at major receivers.
DNSSEC validation walks the chain from the root. We surface whether the zone is signed, whether the DS record at the parent matches the zone's KSK, and whether the chain terminates cleanly. Half-broken DNSSEC (signed zone, missing DS) is a common silent failure - resolvers either bypass it or hard-fail depending on configuration.
CAA tells CAs which issuers are authorized to mint certs for you. Missing CAA means any public CA can issue, which is the mis-issuance vector that bit several large companies in the past decade. We check both apex CAA and the inheritance chain up to the registered domain.
How to read the results
DNSSEC unsigned is fine if intentional - many major brands skip it. DNSSEC partially configured (signed zone with no DS at parent) is broken and worth fixing.
CAA missing is a posture gap. Add at minimum: 0 issue "letsencrypt.org" (or whoever your CA is) and 0 iodef "mailto:[email protected]" so attempted mis-issuance gets reported to you.
Blacklist hit on MX IP matters more than on apex - it's specifically about your mail's deliverability. If you're on a shared mail provider's IP and they get listed, the fix is provider-side; if it's your own MX, escalate via the blacklist's delisting flow.