Free check
The zone underneatheverything else.
Mail and web both rest on DNS. A zone with one name server, or no CAA record, is a single bad day away from taking both down with it. Read-only, from public records, and nothing is stored.
The domain goes to our resolver and nowhere else. Nothing is stored, and the report is yours to keep.
For machines: the same report is JSON at /api/dns?d=yourdomain.
Questions
What does this actually read?
Public records, and only by asking: NS, CAA, SOA, A and MX, plus one query for a subdomain nobody would register, to see whether a wildcard answers. That is the whole of it.
Do you try a zone transfer?
No. An AXFR attempt is a probe rather than a read, and it appears on other DNS reports precisely because it usually fails. We do not send requests whose expected answer is a refusal. We also do not guess subdomain names: where a subdomain is genuinely public, Certificate Transparency already publishes it.
What does the score out of 100 mean?
Four scored sections: name servers 35, CAA 30, SOA 25, wildcards 10. Name servers carry the most because losing them loses everything else, including the ability to repair it. CAA is next because it is the only record here that stops somebody else obtaining a certificate for your name.
Why are cache lifetimes reported but not scored?
Because a short TTL is a design choice and we cannot see the reason for it. An early version scored them and marked a very large operator down for a seven-second record, which is not a misconfiguration but how you fail over quickly at that size. Nothing observable from outside separates a deliberate short TTL from a careless one, so the value is stated and the judgement is left to somebody who knows the architecture.
Why is DNSSEC not tested?
Verifying it needs DS and DNSKEY reads this runtime does not provide. The only alternative is to ask a public resolver and present its verdict as ours, which would be reporting somebody else's answer as our own work. It is marked not tested.
My zone has two name servers and still shows a warning. Why?
Because both are under one provider. Two servers behind one company share that company's outages, its billing, and its bad days. The check reads the parent domain of each name server and looks for more than one, so redundancy means independent rather than merely plural.
How do I add a CAA record?
Three records at the zone apex, in whatever DNS panel you use. An issue record naming the authority you actually use, for example issue "letsencrypt.org". An iodef record with a mailto: address, so an attempted mis-issue reaches somebody. And an issuewild record: either the same authority, or a bare semicolon to forbid wildcard certificates for the name entirely, which is the stricter choice if you never intend to use one. Adding CAA does not affect certificates you already hold.
What breaks if I get this wrong?
CAA is the one to be careful with. Name an authority you do not use and your next renewal is refused, which surfaces as an expired certificate rather than as an obvious CAA error. Check which authority actually issues for you before you write the record, and remember that a renewal reads CAA fresh every time.
Send a brief. A person reads it.
Tell us what you are running today and what you want it to do instead. You will not get a form letter back. The person who writes to you is the same one who would do the work.
Mon–Fri 08:30–21:00 · Sat–Sun 11:00–21:00 CETReply within 48 hours, S/MIME-signed.