What we check
54 checks, across delegation, the nameservers themselves, mail delivery and authentication, the web endpoint, reputation and registration. Each has a stable id that is never renamed, so you can alert on specific ones through the API.
Severity
pass- The check succeeded.
info- Worth knowing, not a fault. Most “you could also do X” findings.
warn- Works today, but fragile, non-standard, or one change from breaking.
fail- Broken now, or breaking for some portion of the internet.
unknown- We could not measure it — almost always our own network, such as a blocked outbound port. Never a statement about the domain, and excluded from the score.
not_applicable- There was nothing to measure. A domain publishing a null MX has no mail server to connect to, so the SMTP checks do not run at all — which is different from a probe we failed to complete. Excluded from the score.
Defect or hardening
Every check also declares what it grades, which is what stops an unpublished text file looking like a broken delegation.
defect- Something is broken, misconfigured, or breaking for part of the internet.
hardening- Something optional is not in place. Worth doing, nothing is wrong today.
How the score is worked out
A straight deduction from 100: every check that fails or warns costs points, a hardening check never costs anything, and there is no ceiling or banding — more findings always score lower than fewer. The full breakdown covers the formula, a worked example, every check’s weight, and when a domain gets no score at all rather than a low one.
Delegation
What the registry has on file.
DNSSEC lets resolvers verify answers really came from the zone owner.
delegation.dnssecThe parent zone must refer resolvers somewhere for the domain to resolve at all.
delegation.existsGlue breaks the chicken-and-egg problem of a zone's nameservers living inside the zone.
delegation.glueRegistry and zone agree on the nameservers
When the two disagree, some resolvers use one set and some the other, which produces intermittent failures that are very hard to diagnose from the outside.
delegation.ns-matchA correct parent answers with AA=0 and the NS set in the authority section, which is how resolvers walk down the tree.
delegation.parent-refersEverything in this section compares what the registry has on file against what the domain's own nameservers say.
delegation.registry-respondedThe parent zone is the authority on which nameservers a domain is delegated to. Comparing it against what those nameservers claim is how delegation faults are found.
delegation.registry-unreachable
Nameservers
How each server actually behaves.
Two or more means one server can fail without taking the domain off the air.
ns.countNameservers are independent of each other
Two nameservers in the same rack fail together. Diversity is what makes a second nameserver actually redundant rather than decorative.
ns.diversityNameserver hostnames are valid
NS records must name a host, not an address, and that host must not be a CNAME. A nameserver on a private address is unreachable from the internet.
ns.hostnamesIPv6-only networks exist, and resolvers on them prefer nameservers they can reach directly.
ns.ipv6Nameservers are not open resolvers
An authoritative server that also answers recursive queries for strangers gets used as an amplifier in DDoS attacks, and lands on blocklists within days.
ns.open-recursionNameservers agree on the SOA serial
The serial is the zone version. When servers report different serials, at least one is serving stale data and zone transfers are failing.
ns.serial-agreementNameservers agree on the NS set
Disagreement here means resolvers can end up with different views of the zone.
ns.set-agreementRFC 7766 makes TCP mandatory. Any answer too big for a UDP packet — DNSSEC, long TXT records, large MX sets — is retried over TCP, and a server that only speaks UDP silently fails those.
ns.tcpUDP port 53 is how essentially every DNS query arrives.
ns.udpZone transfers are not open to the world
An open AXFR hands an attacker every hostname in the zone — including the ones you never published — for the cost of a single query.
ns.zone-transfer
SOA
Zone metadata and timers.
The MNAME names the primary — the server secondaries pull from and the target of dynamic updates.
soa.mname-listedThe SOA defines the zone: who is primary, who to contact, and the replication timers.
soa.presentContact address is well-formed
The RNAME is the published route for someone to report a problem with this zone. Nobody checks it until they urgently need it.
soa.rname-validThe serial must increase on every change, or secondaries never pull the update.
soa.serial-formatThese govern how fast changes reach secondaries and how long a secondary keeps serving after losing contact with the primary.
soa.timers
Mail delivery
MX records and mail servers.
Duplicate hosts add no redundancy, and duplicate preferences make delivery order arbitrary.
mail.mx-duplicatesMX records tell the world where to deliver mail for this domain.
mail.mx-presentMost large receivers check that a sending IP has a PTR, and that the PTR name resolves back to the same IP. Missing or mismatched reverse DNS is one of the most common causes of mail landing in spam.
mail.mx-ptrMX hosts resolve to public addresses
An MX that does not resolve, or resolves to a private address, cannot receive mail from the internet.
mail.mx-resolvesMX targets are hostnames with address records
RFC 2181 §10.3 forbids an MX target being a CNAME. Some senders follow it anyway, others reject the domain outright — so it fails for a subset of your mail.
mail.mx-targetsThe advertised capabilities show what the server supports, including size limits and AUTH.
smtp.capabilitiesConfirms the MX records lead to something that actually speaks SMTP.
smtp.connectWithout STARTTLS, mail crosses the internet in plain text and anyone on the path can read it.
smtp.starttlsOpportunistic TLS encrypts but does not authenticate. MTA-STS and DANE are what turn it into a real guarantee, and both require the certificate to match the MX hostname.
smtp.tls-certificate
Mail authentication
SPF, DKIM, DMARC and transport security.
Informational — BIMI affects how mail is displayed, not whether it is delivered.
mailauth.bimiDKIM signs outgoing mail so receivers can verify it was not altered. Unlike SPF, it survives forwarding, which is why DMARC needs it.
mailauth.dkim-probeDMARC turns SPF and DKIM results into an instruction receivers actually act on.
mailauth.dmarc-presentMTA-STS stops an attacker on the path from stripping STARTTLS and reading your mail.
mailauth.mta-stsMTA-STS stops an attacker on the path from stripping STARTTLS and reading your mail.
mailauth.mta-sts-policySPF ends with an all-mechanism
The all-mechanism says what to do with senders not on the list.
mailauth.spf-allSPF stays within the 10-lookup limit
Past 10 lookups receivers return permerror and SPF stops working.
mailauth.spf-lookupsSPF lists the servers permitted to send mail as this domain.
mailauth.spf-presentSPF avoids the `ptr` mechanism
`ptr` is deprecated and unreliable — some receivers ignore it outright.
mailauth.spf-ptrTLS-RPT is how you find out that mail to you is failing TLS, rather than guessing.
mailauth.tls-rpt
Web & TLS
Address records, certificates and security.txt.
The apex record is what answers when someone types the bare domain name.
web.apex-addressThe zone apex must carry SOA and NS records, and a CNAME may not coexist with other records at the same name.
web.apex-cnameCAA limits which certificate authorities can issue a certificate for your domain.
web.caaConfirms visitors reach this site over HTTPS without a warning.
web.httpssecurity.txt is where a researcher looks for somewhere to report a vulnerability.
web.security-txtA wildcard makes every possible subdomain resolve, which hides typos and lets anyone point a plausible-looking hostname at your infrastructure.
web.wildcardMany people still type www, and old links often include it.
web.www
Reputation
Blacklist status.
A listed mail server has its mail rejected or spam-foldered by many receivers.
reputation.summary
Registration
Registrar records.
A name with no registration record cannot resolve for anyone, whatever its DNS records would say if it existed — so nothing else in this report is meaningful until this is.
registration.existsAn expired domain stops resolving entirely, whatever the DNS says.
registration.expiryHolds and pending deletions take a domain off the internet regardless of its DNS.
registration.statusThe lock is what stops someone who has compromised your registrar account, or forged an authorisation, from moving the domain away before you notice.
registration.transfer-lock
Something missing, or a check you disagree with? Tell us— the reasoning behind each one is meant to be arguable.