DNS Health Checker
SPF, DKIM, DMARC, MX, NS, SOA, and CAA inspected live, with findings and remediation guidance.
DNS Health Diagnostic
What We Check
Five DNS Layers That Determine Operational Reliability
Each record type plays a distinct role. A gap in any one can cause service disruptions, email failures, or compliance findings.
SPF
Authorizes which servers can send email for your domain. Missing or overly permissive SPF enables spoofing of your domain by external parties.
DKIM
Adds cryptographic signing to outbound email. Verified against common selectors — non-standard selectors may require direct verification with your email provider.
DMARC
Sets the enforcement policy for SPF/DKIM failures. None, quarantine, or reject — each reflects a different level of governance maturity.
MX Records
Controls inbound email routing. Priority ordering, host validity, and redundancy are checked. MX misconfigurations silently drop inbound mail.
NS Records
Identifies authoritative nameservers. Stale or single-provider NS records create DNS resolution risk across all domain-dependent services.
How It Works
What this tool does with your input
How this tool works, and what happens to what you enter
- You
You enter a domain or URL
One field. No account, no email required to run it.
- The tool
IT KORR reads the public record
The lookup runs server-side against publicly published DNS, TLS and HTTP data. The target is validated before any request is made.
- You
You get findings you can act on
What is wrong, why it matters operationally, and what to change — not a score.
What To Look For
Reading Your DNS Health Results
Signal
What good looks like
SPF Hard Fail
Prefer "-all" (hard fail) over "~all" (soft fail). Ensure all sending sources — including any third-party email services — are included before tightening enforcement.
DMARC Enforcement Level
"p=none" is monitoring only. Advance to "p=quarantine" or "p=reject" once legitimate sending sources are confirmed. Include a "rua=" reporting address for visibility.
MX Priority Ordering
Primary MX should have the lowest priority number (e.g. 0 or 10). Backup/secondary MX should have higher numbers. Verify all listed hosts are valid, resolving mail servers.
MX Redundancy
At minimum two MX records pointing to different hosts provides delivery resilience. Single-MX configurations are a single point of failure for inbound email.
NS Redundancy
At least two NS records from different providers or IP ranges ensure DNS resolution remains available if one nameserver is unavailable.
SPF Hard Fail
Prefer "-all" (hard fail) over "~all" (soft fail). Ensure all sending sources — including any third-party email services — are included before tightening enforcement.
DMARC Enforcement Level
"p=none" is monitoring only. Advance to "p=quarantine" or "p=reject" once legitimate sending sources are confirmed. Include a "rua=" reporting address for visibility.
MX Priority Ordering
Primary MX should have the lowest priority number (e.g. 0 or 10). Backup/secondary MX should have higher numbers. Verify all listed hosts are valid, resolving mail servers.
MX Redundancy
At minimum two MX records pointing to different hosts provides delivery resilience. Single-MX configurations are a single point of failure for inbound email.
NS Redundancy
At least two NS records from different providers or IP ranges ensure DNS resolution remains available if one nameserver is unavailable.
Why DNS Governance Matters
DNS Misconfigurations Are Silent Operational Risks
DNS errors do not always produce obvious failures. Many go unnoticed until an audit, a client report, or an operational incident surfaces them.
Pre-Migration Validation
Before any domain transfer, email provider migration, or cloud infrastructure change, baseline DNS health should be documented and verified. Migrations frequently introduce MX errors, SPF regressions, and NS propagation issues that are caught too late.
Compliance Audit Readiness
DNS configuration is reviewed in HIPAA technical safeguard assessments, SOC 2 audits, and NIST 800-171 evaluations. Missing DMARC enforcement and improper MX configuration are regularly cited findings. DNS governance documents clean operational baseline.
Email Continuity
A single incorrect MX record can silently drop inbound mail. NS record errors can cause intermittent resolution failures that appear as random connectivity issues. Both are operationally costly and difficult to diagnose without a structured DNS baseline.
Vendor Onboarding
Adding a new email service, CRM, or marketing platform often requires SPF and DKIM modifications. Without a current baseline, these changes introduce risks — including breaking existing records or exceeding SPF lookup limits.
FAQ
Common Questions
What does a DNS health check cover?
This tool inspects five record types: SPF (authorized email senders), DKIM (email signing), DMARC (authentication policy), MX (mail routing servers), and NS (authoritative name servers). Together these represent the core operational and email security posture of a domain.
Why do MX records matter beyond just email?
MX record misconfigurations are among the most common causes of email delivery failures. Incorrect priority ordering, records pointing to non-existent hosts, or missing redundancy can silently drop inbound mail — a critical issue for healthcare, legal, and financial organizations where email is a regulated communication channel.
What are NS records and why should I verify them?
NS (Name Server) records identify which DNS servers are authoritative for your domain. Stale, incorrect, or single-point NS records cause resolution failures across all DNS-dependent services — email, web, VPN, and application access. Always verify NS configuration after domain transfers or registrar changes.
How is this different from the SPF/DKIM/DMARC Checker?
The SPF/DKIM/DMARC Checker focuses exclusively on email authentication records. The DNS Health Checker provides a broader operational view — adding MX routing and NS configuration — making it more useful for pre-migration validation, infrastructure audits, and general operational health reviews.
Why do I have two NS records but the tool shows a warning?
Two nameservers is the minimum recommended for redundancy, and the tool reports "pass" for two or more. If you're seeing a warning, verify that both NS records are resolving correctly and that neither is stale from a previous registrar or DNS provider.
I changed my DNS settings — how long until this tool shows updated results?
DNS propagation can take minutes to 48 hours depending on TTL settings. This tool queries live DNS via Cloudflare's DNS-over-HTTPS resolver, which typically reflects changes within minutes to a few hours. If results appear stale, wait for TTL expiry and recheck.
Related Operational Resources
Deep analysis of email authentication records with detailed recommendations.
Inspect certificate validity, expiration, and TLS version for any domain.
Trace the full redirect chain for any public URL.
Ongoing infrastructure operations including DNS governance and monitoring.
Cloud operations and infrastructure management including DNS architecture.
How DNS, DHCP, and IP address management work together, and why losing any one of them takes down far more than it appears to.
MX/NS misconfigurations, and what DNSSEC and CAA records actually do versus what a scan can detect.
Operational Support
Need help resolving DNS issues?
IT KORR can coordinate DNS configuration, email routing fixes, and name server migrations with your current providers — no migration required.
No commitment required — we respond within one business day.