DNS Health Check
Audit delegation, nameservers, SOA, MX and mail records end to end, intoDNS style.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is DNS Health Check?
DNS Health Check audits a domain's delegation end to end: agreement between the parent zone's NS records and the authoritative servers, nameserver count and network diversity, SOA parameters, MX configuration and the DNSSEC chain.
The checks go beyond record presence — they query the authoritative servers directly on port 53 to confirm that SOA serials agree and that the servers refuse open recursion.
Those two are the ones that usually go unnoticed and cost the most: mismatched serials mean zone transfer has stalled, and open recursion gets your server used in DNS amplification attacks.
Frequently Asked Questions
10 questionsHow is this different from intoDNS?
It follows the same logic: delegation, nameserver diversity, SOA timers, MX/PTR and mail records. On top of that it checks SPF/DMARC and CAA/DNSSEC, scores the result 0-100, and exports to JSON/PDF.
How is SOA serial agreement measured?
That check queries each nameserver directly over port 53 — public DoH resolvers cannot target a specific server. If outbound 53 is blocked from this environment the result is never guessed; it is marked "could not determine". The same applies to the open-recursion probe.
I use two DNS providers and the serials differ — is that a problem?
Two independent providers (e.g. Route 53 + NS1) keep their own counters, so the values legitimately diverge. For secondaries fed by AXFR/IXFR from one primary, a serial mismatch does mean the transfer or NOTIFY chain is broken. The tool lists the raw values; interpret them against your setup.
Do "info" checks lower the score?
No — only failures and warnings reduce it. "Info" is either a neutral observation (listing your CAA records) or a note that the check could not run from this environment. We keep that distinction because counting an unperformed check as a pass would be misleading.
How is this different from intoDNS?
It doesn't stop at record presence — it queries your authoritative servers directly on port 53. That's what makes it possible to check whether SOA serials agree across servers and whether the servers refuse open recursion; neither is visible from a public resolver.
What does an SOA serial mismatch mean?
Your secondary nameservers aren't receiving current zone data from the primary. Usually zone-transfer (AXFR/IXFR) authorisation has broken or NOTIFY messages are firewalled. The effect is that users get different answers depending on which server they hit.
Why is open recursion dangerous?
A publicly recursive server is used in DNS amplification attacks: the attacker spoofs the victim's source IP, sends a small query, and your server sends the large response to the victim. Authoritative servers should have recursion off.
How should I read "could not determine"?
As "the check couldn't run", not "it passed". In the open-recursion probe, only an explicit REFUSED/SERVFAIL counts as closed; a timeout is ambiguous because the packet may simply have been dropped by a firewall.
How many nameservers should I run?
At least two, ideally on different networks and different providers. RFC 2182 advises against concentrating them in one location — two servers in the same /24 make a single network outage take the domain off the internet.
When are glue records needed?
When your nameservers live under the domain they serve (ns1.yourdomain.com). The resolver would have to resolve the very domain it can't resolve yet; the parent registry's glue A record breaks that loop.