How to Run a Domain DNS Health Check (and What the Results Mean)
Most DNS problems stay invisible until something breaks. A client suddenly stops receiving your invoices, or a marketing campaign gets flagged as spam, and only then do you discover a misconfigured record that had been sitting there for months. A domain DNS health check catches these issues before they cost you. This guide walks through each check our DNS Health Checker runs and explains what a pass or a fail actually means.
What a DNS health check covers
Our tool runs six checks in a single pass and returns a score alongside a clear pass or fail badge for each one.
1. Nameservers (NS)
This check confirms the domain has at least two authoritative nameservers. Two nameservers give the domain redundancy, so it stays reachable even if one nameserver goes offline. Our NS lookup guide explains nameservers in more depth.
2. A or AAAA record
This check confirms the domain actually resolves to an IP address. Without at least one of these records, visitors and services simply cannot reach the domain, no matter how well the rest of the setup works.
3. MX records
This check confirms mail servers exist for the domain, meaning it can receive email at all. See our MX lookup guide for a deeper look at common mail delivery mistakes.
4. SPF record
SPF stands for Sender Policy Framework. It is a TXT record that lists which servers a domain authorises to send email on its behalf. Receiving mail servers check this record, and a missing SPF record makes it far easier for someone to spoof your domain in a phishing email.
5. DMARC record
DMARC builds on SPF and DKIM by publishing a policy, at
_dmarc.yourdomain.com, that tells receiving mail servers what to do with messages that
fail those checks, and where to send reports about them. A domain without DMARC leaves that decision
entirely up to whichever mail server happens to receive the spoofed message.
6. SOA record
This check confirms the DNS zone itself carries a valid primary nameserver and the refresh, retry and expire timers that keep secondary nameservers synchronised. Our DNS records guide explains what each of these timers controls.
Reading your score
The tool calculates a percentage score based on how many of the six checks pass. A domain scoring below 80 percent usually has at least one issue worth fixing soon, particularly if the failing check involves MX, SPF or DMARC, since those directly affect whether your email actually reaches an inbox. A domain that only serves a website and never sends or receives email can safely ignore MX, SPF and DMARC failures and focus on the NS, A or AAAA, and SOA results instead.
When to run this check
- Right after you migrate hosting providers or DNS providers.
- After you switch email providers, for example moving to Google Workspace or Microsoft 365.
- Periodically, as a routine sanity check, since DNS records can drift or get accidentally removed during unrelated changes.
- Whenever you troubleshoot a specific issue, such as email landing in spam or a site failing to resolve.
Try it yourself
Run a full check on any domain right now with the DNS Health Checker. If you find an SSL related issue while you're at it, our SSL Certificate Checker and its accompanying guide cover that separately.
Back to all posts