What does this DNS health check tool actually check?

It checks core records (A, AAAA, NS, MX), email authentication (SPF, DKIM, DMARC), CAA certificate authority restrictions, DNSSEC validation status, and reverse DNS on the domain's primary IP, all in one pass.

Why didn't it find my DKIM record?

DKIM records live at a selector-specific address that cannot be discovered automatically. This tool checks common selectors used by major providers and lets you enter your own. A miss usually means an uncommon selector, not a missing record.

What does the DNSSEC result actually mean?

It reflects Google Public DNS's own validation flag on the response, not an independent chain-of-trust check performed by this tool. A validated result means Google's resolver confirmed the signatures; unvalidated usually means the domain is not signed.

Is this the same as checking DNS propagation?

No. This tool checks one resolver's current view of a domain's records. To compare results across multiple resolvers after a change, use a dedicated DNS propagation checker instead.

DNS Health Checker – Check SPF, DKIM & DNSSEC Free

DNS Health Checker

Check core records, email authentication, DNSSEC, CAA, and reverse DNS for any domain in one pass.

What you’re getting: this reads one resolver’s (Google Public DNS) current view of the domain. It is not a full authoritative-server check, and it does not compare results across resolvers.

DKIM only checks common provider selectors plus any you enter, since a selector cannot be discovered automatically. DNSSEC reflects Google’s own validation flag, not an independent signature check performed here.

Checking whether a recent change has spread everywhere yet? Use a DNS propagation checker instead, that compares multiple resolvers side by side.

Domain

DKIM selector (optional)

Found in your email provider’s DKIM setup instructions, usually as part of a CNAME or TXT record name like selector._domainkey.yourdomain.com.

DNS Health Checker

What This Tool Does

A domain’s DNS involves several independent pieces that normally get checked one at a time: the records that point to your server, the records that authenticate your outgoing mail, and the signatures that prove your DNS hasn’t been tampered with. This tool runs all of it in a single pass so you get one report instead of five separate lookups.

What Gets Checked

Core records. A, AAAA, NS, and MX, the records that make the domain reachable and route its mail.
Email authentication. SPF and DMARC from TXT records, plus DKIM against common provider selectors and any selector you supply.
CAA. Whether the domain restricts which certificate authorities may issue TLS certificates for it.
DNSSEC. Whether the resolver’s response validated against the domain’s DNSSEC signatures.
Reverse DNS. Whether the domain’s primary IP resolves back to a hostname.

Reading the Result

Each line is flagged ok, warning, or informational. A warning does not always mean something is broken: a domain with no CAA record isn’t misconfigured, it simply hasn’t restricted which certificate authorities can issue for it, which most domains never do. Read the note under each flagged item before treating it as a problem to fix.

Related Tools & Guides

For a single record type on demand, use the DNS Lookup tool. Compare a recent change across multiple resolvers with the DNS propagation checker. For the mechanics behind every record type here, see DNS Records Explained and DNSSEC Explained. Setting up email authentication from scratch is covered in How to Set Up SPF and DMARC Without Breaking Email. This check doesn’t cover MTA-STS or TLS-RPT; run those separately with the MTA-STS and TLS-RPT Checker.