DNS Health Checker

A record (IPv4), AAAA record (IPv6), MX record (mail), NS record (nameservers), TXT record (SPF/DMARC), SOA record, CAA record (SSL authority), and www CNAME.

SPF (Sender Policy Framework) authorizes mail servers to send email for your domain. DMARC (Domain-based Message Authentication) builds on SPF and DKIM to protect against email spoofing.

Yes, the DNS Health Checker is 100% free with no registration, no hidden fees, and no usage limits. All processing happens locally in your browser, ensuring complete privacy.

Absolutely. The DNS Health Checker processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the DNS Health Checker is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the DNS Health Checker in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The DNS Health Checker works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

The checker grades each record by how badly its absence breaks the domain. A fail marks something likely to stop the site from working — no A record means browsers cannot resolve the address, and no NS or SOA record means the DNS zone itself is misconfigured. A warning flags a real gap that is not fatal: a missing MX record means email cannot be delivered, and SPF without DMARC leaves the domain easier to spoof. Pass means the record exists and looks healthy, while info is a neutral note about optional records like IPv6 (AAAA) or CAA. Three counters at the top tally how many records passed, warned, or failed, so you can see at a glance whether a problem is urgent or just worth tidying up. Run a check to see exactly which records carry each status.

The checker looks up the MX records on the exact domain you typed, with no www and no subdomain. If your mailboxes actually live on a subdomain, or your domain receives mail through a provider that publishes MX records elsewhere, the root domain you entered may genuinely have no MX record — so the tool correctly flags a warning even though your everyday email works. It is also common for a domain used only for a website to have no MX record at all by design. Because a missing MX means mail addressed to that exact domain cannot be delivered, the tool treats it as a warning rather than ignoring it. Check that you entered the right domain, then confirm the mail servers listed match your email provider. Run the check to see the full MX detail it found.

A CAA (Certification Authority Authorization) record names which Certificate Authorities are allowed to issue SSL certificates for your domain, reducing the risk that a rogue or mis-issued certificate is created elsewhere. In this tool a CAA record is treated as optional, so its absence is shown as an info note, never a fail — without one, any CA can issue certificates for your domain, which is the normal default. Adding a CAA record is a sound hardening step, especially for high-value or brand domains, but it is not required for the domain to resolve or send email. So you can have a perfectly healthy domain with no CAA record at all. The checker shows any CAA values it finds alongside a short explanation. Run a scan to see whether your domain restricts certificate issuance.

In almost all cases, yes. This tool resolves records in real time through Cloudflare's DNS-over-HTTPS resolver, so the query travels encrypted over HTTPS instead of plaintext DNS, but it returns the same authoritative records that dig or nslookup would return for that name. The main difference is propagation and caching: if you just changed a record, Cloudflare's resolver may still serve a cached older value until the previous TTL expires, exactly as any resolver would. You may also see slightly different results than a tool querying your local ISP resolver, since each resolver caches independently. For confirming whether a record exists, its values, and its email and security configuration, the results match a terminal lookup without you needing to learn dig syntax. Enter a domain to run all eight lookups at once.

The checker looks up www.yourdomain specifically as a CNAME (alias) record. Many domains do not use a CNAME for www at all — instead they point www directly to an IP using its own A record, or handle www through their hosting platform's redirect rules. When no CNAME is found for the www host, the tool reports info rather than a fail, because an absent CNAME does not mean www is broken; it just means www is configured a different way. So an info result here is normal and not something you need to fix. If you intended www to alias your root domain and it shows no record at all, that is worth checking, since visitors typing www may not reach your site. Run the check to see exactly what the www host resolves to.