DNS Checker

Check a domain’s DNS health

Every email check depends on DNS answering reliably. Check the nameservers, the SOA record and DNSSEC behind a domain.

Guide

What the DNS checker tests

  • At least two nameservers, as RFC 2182 requires, each resolving to a public address.
  • Network diversity. Nameservers all in one /24 can be taken out together by one routing problem. Anycast providers are the usual exception.
  • SOA timers within the ranges RFC 1912 and common operational guidance recommend: refresh, retry, expire, and the negative-caching TTL.
  • DNSSEC, from the validating resolvers' AD flag.

A browser reaches DNS only through public resolvers, never each nameserver directly. So checks that need per-server queries — whether every server is authoritative, whether they agree on the SOA serial, whether they allow zone transfers — are marked not verifiable.

FAQ

DNS: common questions

How many nameservers should a domain have?

At least two, on different networks, as RFC 2182 requires. Most DNS providers give you two to four. With a single nameserver, any outage takes the whole domain offline, including its email.

What do the SOA timers mean?

Refresh is how often secondary nameservers check for changes, retry how soon they try again after a failure, expire how long they keep serving the zone without reaching the primary, and the minimum field sets how long resolvers cache "name does not exist" answers.

Why does DNS health matter for email?

MX, SPF, DKIM, DMARC and MTA-STS are all DNS records. If the nameservers are slow or unreachable, receivers cannot look them up, and mail can be delayed, rejected, or fail authentication.

Guides

Learn more