DNS Lookup

Name servers are queried directly

Having NS records listed is one thing; whether the servers behind them answer is another. The tool contacts each one and reports whether it responds, how many milliseconds the reply takes, and which zone serial number it returns. Serial numbers that drift apart point to a familiar problem after a migration: some visitors keep getting stale records for days, and a plain record listing never shows it.

The mail trio

SPF, DMARC and DKIM decide whether mail from your domain gets delivered, and whether anyone can send forged mail in its name. The SPF check looks for the typical mistakes: two records instead of one, more than ten DNS lookups, a pointless +all. For nested include records, use the TXT record lookup. For DMARC the tool reports the policy: p=none only observes, p=reject rejects forged mail.

DKIM needs a selector, the value after s= in the DKIM-Signature header of a sent message. Enter it in the form and the signature gets checked along with everything else.

What else gets checked

• CNAME on the domain itself, a forbidden combination that some resolvers stumble over;
• A records pointing into a private network: 192.168.x is unreachable from the internet;
• the www version: visitors typing www get an error if the record was never set up;
• CAA: without it, any certificate authority can issue a certificate for the domain;
• Null MX, an explicit refusal of mail, which beats silence; the MX record lookup examines each mail server separately;
• a low TTL, justified only during a migration.

Unlike running dig or nslookup by hand, here every record type arrives in a single pass, already analyzed. Queries go straight to the name servers over the DNS protocol, with no middlemen.