A DNS health check is a read-only inspection of the public records and services that help a domain resolve, receive email and use HTTPS securely. A useful check reviews delegation, address records, mail routing, sender-authentication records, SSL/TLS, DNSSEC and CAA. It shows evidence from the moment the check ran; it does not guarantee that the configuration will stay healthy.
What changed in this guide?
- September 2026: The guide now separates a one-time diagnostic from continuous monitoring.
- September 2026: SPF, DKIM and DMARC limitations are described without claiming access to private mail systems.
What does a DNS health check examine?
A DNS health check examines information that the public internet can query without passwords or account access. The result depends on which records are published, the resolver used at that moment, and whether related services such as HTTPS and mail are reachable.
| Area | What the check can inspect | Why it matters |
|---|---|---|
| Delegation | Authoritative nameservers and delegation consistency | Incorrect delegation can make the whole domain unreachable |
| Website routing | A, AAAA and CNAME answers | These records direct visitors to website or application endpoints |
| Mail routing | MX records | MX records tell senders where to deliver mail for the domain |
| Sender policy | SPF, DMARC and observable DKIM information | These records help receiving systems evaluate authorised senders and message authentication |
| HTTPS | Certificate validity, hostname coverage and expiry evidence | Certificate problems can trigger browser warnings or failed connections |
| DNSSEC | Public signing and delegation posture | DNSSEC can help resolvers detect forged DNS responses when correctly deployed |
| CAA | Published certificate-authority restrictions | CAA can limit which certificate authorities may issue certificates for a domain |
What can a DNS health check find?
A DNS health check can identify missing, conflicting, expired or risky public configuration. Examples include an address record pointing to the wrong service, missing MX records, multiple SPF records, a DMARC policy problem, an expiring certificate, inconsistent nameserver answers, or a DNSSEC chain that does not validate.
A finding is evidence to investigate, not permission to change production DNS immediately. Record the current configuration, confirm who owns each service, and prepare a rollback before editing records.
What can a DNS health check not prove?
A public DNS health check cannot inspect private dashboards, application configuration, mailbox contents, passwords or private network zones. It also cannot prove that every legitimate mail stream signs with DKIM when the selector is unknown, or that a clean public configuration will remain unchanged after the test.
- A clean result does not guarantee future availability.
- Public DNS cannot confirm that an application works correctly behind its address.
- SPF, DKIM and DMARC records do not by themselves prove inbox placement.
- DNS propagation cannot be reduced to one universal percentage or completion time.
- A diagnostic is not a legal or regulatory compliance certification.
When should you run a DNS health check?
Run a DNS health check before and after any change involving a domain, website, email service, nameserver, certificate or hosting migration. The before-result records the observable baseline. The after-result helps confirm that the intended public records and services are visible.
- Before changing nameservers or moving hosting
- After adding a business email provider
- When mail bounces or recipients report authentication failures
- When a browser reports a certificate warning
- After enabling DNSSEC or changing a registrar
- During incident investigation
What is the difference between a DNS health check and DNS monitoring?
A DNS health check is a snapshot; DNS monitoring repeats checks and alerts approved recipients when relevant conditions change. The Cloud Market free DNS health check accepts three checks per rolling 24 hours and does not change DNS or hosting. Advanced DNS Security Monitoring is a separate service that establishes a baseline, checks for drift and security findings, and remains read-only.
| Capability | One-time health check | Continuous monitoring |
|---|---|---|
| Purpose | Inspect the current public state | Detect later drift or recurring problems |
| Timing | Runs when requested | Runs on a defined schedule |
| Alerts | No ongoing alert relationship | Alerts approved recipients according to the service |
| DNS write access | Not required | Not required for read-only monitoring |
How should you interpret common DNS findings?
Missing or unexpected A and AAAA records
A and AAAA records should point only to endpoints that are intended to serve the hostname. Confirm both IPv4 and IPv6 paths before removing an unexpected record, because users may reach either protocol.
More than one SPF record
A domain should not publish multiple competing SPF TXT records for the same name. Consolidate authorised senders into one valid policy after verifying each mail source.
No DMARC policy
DMARC helps domain owners request handling for messages that fail aligned authentication and receive reports. Introduce or strengthen a policy carefully after confirming that legitimate senders authenticate correctly.
Certificate expiry or hostname mismatch
An HTTPS certificate must be valid for the hostname a visitor opens. Renew or replace an expiring certificate through the service that terminates TLS, and confirm that redirects do not send users to an uncovered hostname.
DNSSEC validation failure
A broken DNSSEC chain can make a domain appear unavailable to validating resolvers. Coordinate changes between the DNS operator and registrar; stale DS records are a common migration risk.
Frequently asked questions
Does a DNS health check change my records?
No. The Cloud Market DNS health check is read-only and does not require passwords, DNS tokens or account access.
How many free DNS health checks are available?
As of 26 September 2026, The Cloud Market accepts three free checks per rolling 24 hours.
Can a DNS check confirm that email will reach every inbox?
No. DNS authentication is one part of delivery. Sender reputation, message content, recipient policy and provider behaviour also affect whether a message is accepted or placed in the inbox.
Does a clean result mean the domain is permanently safe?
No. Records, certificates, delegation and upstream services can change after the check. Use monitoring when the business needs alerts about future drift.
Should a DNS health check be run before migration?
Yes. A pre-migration check creates a public baseline for website, mail, certificate and nameserver records that should be preserved or deliberately changed.
Run The Cloud Market's free DNS health check. It is read-only and accepts one public domain or URL per check.
Sources checked 26 September 2026: The Cloud Market DNS health check, ICANN DNSSEC guidance, and Google Workspace email-authentication guidance.