DNS & Domain Health Analyzer

It checks whether the domain resolves, whether its authoritative nameservers are redundant, whether mail routing and authentication are coherent, and whether DNSSEC and CAA protections are published.

Recursive resolvers cache answers until their TTL expires. During propagation, some resolvers may still return the previous record while others already return the new value.

A domain that never sends email can publish restrictive policies to reduce spoofing. The health score does not penalize missing email authentication when no MX record is published.

No. DNSSEC signs DNS data so validating resolvers can detect forged or altered answers. It provides authenticity and integrity, not confidentiality.