Read the zone the way a resolver sees it.

01Nameservers

Whether the delegated nameservers resolve, answer, agree with each other and carry a consistent SOA serial — mismatched answers are a common cause of problems that come and go.

02Email delivery

Whether MX records are published, resolve to real addresses, avoid CNAMEs, and whether the mail servers have matching reverse DNS.

03Spoofing protection

Whether SPF, DMARC and DKIM are configured so third parties cannot send mail that claims to come from the domain.

04DNSSEC

The full chain of trust, from the DS record published at the parent down to the signatures in the zone, including validity periods.

05Addresses & policies

A, AAAA and CAA records: reachability, IPv6 coverage, and which certificate authorities may issue for the name.

06Zone hygiene

SOA timers, TTLs, wildcards, illegal apex CNAMEs and the remaining records — the details that surface during an incident.

1. Identify the authorityThe parent zone’s delegation is read first, to establish which nameservers genuinely answer for the domain.
2. Query each server directlyEvery record type is read from each authoritative server, and the answers are compared between them.
3. Score and explainA score out of 100, the full record set, and a remediation note for anything that is wrong.

Scoring

The report starts at 100 and loses 15 points for each critical finding, 5 for a warning and 1 for a note. A score of 80 or above is healthy, 50–79 is fair, and below 50 generally indicates something is actively broken.

Programmatic access

The same report is available as JSON, suitable for monitoring and change verification:

GET /api/report?domain=example.com