Domain health check
One report on everything a domain publishes in DNS: its nameservers, whether DNSSEC validates, where the website and mail go, which certificate authorities may issue for it, and whether its zone timers are sane.
Les recherches sont traitées à la demande et ne sont pas conservées. MyIPKit ne garde aucune trace de ce que vous recherchez.
Reading the report
- Broken items stop something working for some or all visitors. Fix these first.
- To improve items work today but leave a gap — usually against forged mail or mis-issued certificates.
- Notes are choices that are often deliberate, such as no IPv6 or no MX on a domain that sends no mail.
For the details behind the mail items use the SPF, DKIM and DMARC check; for the certificate itself, the SSL certificate check.
What does this check look at?
Only what the domain publishes in public DNS, read through a public resolver: NS, SOA, A, AAAA, www, MX, TXT (SPF), DMARC, CAA, DS and DNSKEY. It does not contact the domain’s servers.
Should I turn on DNSSEC?
It stops forged DNS answers, and most DNS hosts manage the keys for you. The one danger is keys at the DNS host and the DS record at the registrar falling out of step — which makes the domain vanish for validating resolvers. Switch it on where the host handles both, and check it here afterwards.
What is a CAA record for?
It lists the certificate authorities allowed to issue certificates for the domain, so a mistaken or tricked authority elsewhere cannot. Add the authority your host or CDN uses before publishing CAA, or its renewals will fail.
Why are two nameservers needed?
If the only nameserver is down, resolvers cannot find anything about the domain — website, mail, everything. Registries require at least two for that reason, ideally on different networks.
Why does a change not show up here yet?
Answers come from a public resolver, which may hold the old records until their TTL expires. [Why a DNS change has not taken effect](/guides/dns-changes-and-ttl) explains the timing.