DNS health check
Grade a domain’s DNS: zone transfer, DNSSEC, CAA, nameserver sync and the SPF lookup limit.
What this checks
The check asks every authoritative nameserver for the zone directly, then looks at how the setup fits together rather than just listing records.
- Zone transfer (AXFR): whether any nameserver hands out the whole zone
- DNSSEC (DS record at the registry) and CAA records
- Whether all nameservers answer over UDP and TCP and share the same SOA serial
- Dangling NS delegation: nameservers that no longer exist
- SPF DNS-lookup count against the limit of 10, and wildcard records
Questions
Why is an open zone transfer a problem?
It gives anyone the full list of hostnames in your zone, including test, staging and admin systems you never meant to advertise. Only your secondary nameservers should be allowed to transfer it.
Is this check intrusive?
No. It sends ordinary DNS queries and one zone-transfer request per nameserver. If a transfer is allowed, only the number of records is kept, never the records.
What does “SPF 12 of 10” mean?
SPF allows at most 10 DNS lookups. Above that, receivers treat SPF as broken (permerror), which is the same as having no SPF. Remove unused includes or replace them with IP ranges.