By Debmedia Technologies LLP · Kolkata, India · Updated
What Is a DNS Health Check?
A DNS health check tests whether a domain’s DNS is correctly set up, reachable and consistent. Instead of asking a public resolver, it connects to each authoritative name server directly and examines the answers. This exposes faults that cached results can hide for hours or days.
Run it after a hosting move, before a launch, or any time your site or email behaves strangely. One report shows delegation, server behaviour, SOA timers, mail records and DNSSEC together.
How to Use This DNS Health Checker
- Enter your domain, such as example.com.
- Select a resolver, which is used to find your name servers.
- Press Check health. Testing every server can take several seconds.
- Work through the list of checks, errors first, then warnings.
What the Report Tests
| Test | What a pass means |
|---|---|
| Name server count | Two or more servers are listed. |
| Network diversity | Servers are spread over different networks. |
| Authoritative answer | Each server answers with the authoritative flag, so it is not a lame delegation. |
| SOA serial match | All servers hold the same version of the zone. |
| Open recursion | Servers do not resolve unrelated domains for strangers. |
| TCP port 53 | Servers accept TCP, needed for large answers and DNSSEC. |
| SOA timers | Refresh, retry, expire and negative TTL are within common ranges. |
| Mail and security records | MX, SPF, DMARC, DNSSEC, CAA and IPv6 records are present where expected. |
Common Findings and Fixes
Not authoritative for the zone
The domain is delegated to a server that does not hold its zone. Add the zone at that provider, or correct the name servers at your registrar.
SOA serials differ
One server is behind. Check zone transfers or the sync feature of your DNS provider. Guidance on running secondaries is in RFC 2182 on running secondary name servers.
Open recursion
Disable recursion on authoritative servers so they cannot be abused in traffic amplification attacks.
Unusual SOA timers
The timer ranges used here follow common practice from RFC 1912 on common DNS errors. Values outside them are shown as notes, not errors, because many providers choose their own.
Go Deeper With Related Tools
- See which servers are in charge with the name server lookup.
- Review the records you publish with the DNS setup validator.
- Test how a change is spreading with the worldwide propagation test.
- Confirm email authentication with the SPF analyzer.
What This Report Does Not Cover
The checker queries your servers from one location and does not verify the registry-side delegation or DNSSEC signature validity in full. It is a fast first diagnosis, not a replacement for a complete audit of a large production zone.
When to Run a DNS Health Checker
Run a DNS health checker before and after any major change: a new host, a new registrar, a launch or a migration. It confirms that every authoritative server answers and agrees, which no single lookup can prove.
It is equally useful as a routine check. A DNS health checker run once a quarter catches slow drift, such as a server that stopped syncing or a record that expired, before it turns into an outage.
Frequently Asked Questions
Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.