devopscodepro
Language
Productized services
Infrastructure AuditRisks, costs and quick wins — mapped in two weeks.Cloud Migration & IaCTerraform, CI/CD and a zero-downtime cutover.Monitoring-as-a-ServiceAlerting, on-call and incident response.Fractional DevOpsA senior engineer in your team, part-time.
Not sure where to start? The audit answers that.Request a quote →
server-assisted · every other tool runs in your browserAll 29 tools →
Infrastructure AuditCloud Migration & IaCMonitoring-as-a-ServiceFractional DevOps
ContactLog in
Request a quote
Theme
Language
server-assisted

DNS health

NS consistency, TTL sanity, dangling CNAMEs and common misconfigurations.

we only read public DNS records — nothing is stored
Enter a domain above to run the check.
These tools show symptoms. A full infrastructure audit finds the causes — risks, cost leaks and single points of failure, mapped in two weeks.
Request a quote →

What the DNS health check looks at

The check queries your domain from a public resolver and then asks each authoritative nameserver directly. That second step is what catches the failures a normal lookup hides: nameservers that disagree about the zone, a server listed in the delegation that no longer answers, or a serial number that stopped advancing on one replica.

On top of delegation it reviews the records that decide day-to-day reliability — SOA timers, TTL sanity, apex records, CNAME misuse at the apex, CAA and DNSSEC.

What is the difference between this and a DNS lookup?

A lookup answers what a record says right now. This check answers whether the zone is set up correctly: whether every nameserver agrees, whether TTLs are usable during an incident, whether the delegation matches what the parent zone publishes.

Why does it warn about a TTL of 86400?

Because a day-long TTL is a day-long outage if you need to move that record in a hurry. Long TTLs are fine for records that never change, but for anything pointing at infrastructure you want a value you can wait out — 300 to 3600 seconds is the usual range.

It says my nameservers are inconsistent. What does that mean?

Two authoritative servers returned different SOA serials, so at least one is serving stale data. Zone transfers have stopped, or a record was edited on one server directly. Until it is fixed, which answer a visitor gets is a coin flip.

Is a missing CAA record a real problem?

It is a warning, not an outage. CAA tells certificate authorities which of them may issue for your domain; without it, any public CA can. Adding one line closes a mis-issuance path that costs nothing to close.

Do I need DNSSEC?

It is signed proof that the answers came from you, which matters most for domains handling email or authentication. It also raises the cost of a mistake: a botched key rollover takes the domain offline for everyone validating. Enable it deliberately, not casually.

Related tools: DNS lookup, Email deliverability and WHOIS lookup.