What does a DNS health check test?

A DNS health check reviews domain resolution, nameserver delegation, SOA authority, mail routing, email authentication, TTL values, CAA controls, and DNSSEC delegation.

Why does DNS look different after I make a change?

Recursive resolvers cache DNS answers until their TTL expires. Different resolvers can temporarily show old and new values during propagation.

Do I need SPF and DMARC if my domain does not send email?

Domains that do not use email can publish restrictive SPF and DMARC policies to reduce spoofing, but the analyzer does not penalize a domain with no MX record for missing email authentication.

Does DNSSEC encrypt DNS traffic?

No. DNSSEC signs DNS data so validating resolvers can detect forged or altered answers. It provides authenticity and integrity, not encryption.

ServerSpan · Herramientas

DNS & domain health analyzer

Check DNS records, nameserver redundancy, mail authentication, certificate controls, TTLs, and DNSSEC for any public domain.

DNS records SPF & DMARC DNSSEC & CAA

DNS health report

Health score, findings, and published records.

Enter a domain to begin

The health report will appear here

La gestión y el alojamiento se diseñan para cada colaboración.

Domain lookup

Enter a public domain to analyze.

Domain name

Enter a root domain or hostname without a path.

Try an example

What We Check

A, AAAA, CNAME, NS, SOA, MX, TXT, and CAA
Nameserver redundancy and mail target resolution
SPF, DMARC, DNSSEC, and TTL health

Back to toolbox

Understanding Your Results

How to read your DNS health report

The report separates configuration failures from optional security improvements, so you can fix availability issues first and harden the domain afterward.

What the health score measures

Availability first

Resolution, nameserver redundancy, SOA authority, mail routing, SPF, DMARC, CAA, and DNSSEC contribute to the score. Email authentication is not scored when the domain publishes no MX record.

When to run the check again

Wait one full TTL

Recursive resolvers keep previous answers until their TTL expires. After changing DNS, wait at least one full TTL before treating a different result as a configuration failure.

Why DNSSEC and CAA matter

Trust controls

DNSSEC lets resolvers detect altered DNS answers. CAA restricts which certificate authorities may issue certificates for the domain. Together they strengthen DNS integrity and TLS issuance control.

Frequently asked questions

Need help with DNS?

We can configure and troubleshoot your domain.

From nameserver delegation and DNSSEC to mail authentication and migration planning, our team can help you deploy a reliable DNS configuration.

Get in touch