EN LV RU

DNS configuration check

One check that looks at the name servers, addresses, mail records and DNSSEC of a domain, and tells you where the problem is.

What this check looks at

  • The name servers, and whether all of them answer with the same data.
  • Whether the domain has an A or AAAA record and whether www resolves as well.
  • The mail records: MX, SPF, DMARC.
  • CAA records and DNSSEC signatures.
  • The SOA serial number and the zone timers.

The faults this check finds most often

The most common fault is a delegation that does not match the zone: the name servers listed at the registry are not the ones listed inside the zone itself. Everything keeps working until a record has to change, and then the change reaches some visitors and not others.

The second most common is a domain that has MX records but no SPF and no DMARC. Mail still leaves, but a large share of receivers file it as spam or refuse it.

Frequently asked questions

Does the check change anything in my DNS?

No. Only read queries are sent to the public name servers. Nothing is written, and no change is made on your side.

What does it mean when the name servers answer differently?

The zone data is out of sync between them. Compare the SOA serial number on each server. If the serials differ, a secondary has not pulled the new version of the zone yet.

What is the difference between the delegation and the NS records in the zone?

The delegation is the NS set the parent zone hands out, and it is what the rest of the world follows. The NS records inside the zone are the answer your own servers give. They should list the same hosts, and when they do not, the result depends on which server was asked.

Is DNSSEC mandatory?

No, but it protects answers from being forged on the way. If you turn it on, keep the DS record at the registry in sync with the keys in the zone. A stale DS record makes the domain stop resolving completely.

Related tools

DNS record lookup

A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records with TTL.

MX record lookup

Mail servers, priorities, IP addresses and PTR records.

DMARC record check

Policy, rua and ruf addresses, alignment and errors.

SSL certificate check

Issuer, expiry, SAN list, chain and TLS protocol.