Website AuditorWebsite Auditor

DNS Checker

Look up A, AAAA, MX, TXT, CAA, SPF, DKIM and DMARC records for any domain with a one-click scan.

Free, unlimited, no signup.

About DNS Checker

DNS is the plumbing that everything else — email deliverability, HTTPS, CDN routing — silently depends on. A missing DMARC record or a stale MX server is a whole category of bug you can't feel until email starts bouncing. This tool queries authoritative DNS from the edge and shows every record type that matters in a single view.

What this tool checks

DNS Checker focuses on the following signals from your site's live response:

  • dnsmodule in the full audit

Why it matters

Signals covered by DNS Checker are the ones attackers, browsers, and search engines look at first. A weak result here means real users are exposed — via downgrade attacks, broken trust warnings, indexing problems, or leaked data — long before anything obvious breaks. Fixing them is usually a config change, not a rewrite, and the impact is immediate.

How to interpret your result

  • Pass — the signal meets modern best practice. Keep it monitored; regressions happen after deploys.
  • Warn — functional but weaker than recommended. Usually a quick header, DNS, or config tweak away from a full pass.
  • Fail — a real risk to users or search visibility. Follow the recommendation shown next to the finding — it's copy-pasteable.

Best practices

  • • Re-run after every deploy — configuration drift is the #1 cause of regressions.
  • • Compare against a competitor's report to spot easy wins.
  • • Wire the public API into CI to gate merges on the score.
  • • Fix warns before failures — they're the cheapest to close and pay off compounding gains.

Frequently asked questions

Yes — lookups are performed via Cloudflare DoH from the edge.

Related guides

Guide

DNS Security Basics

A checklist of DNS records every domain should have — CAA, DNSSEC, SPF, DKIM and DMARC — with why each one matters.

Read

Related articles

headers

Why Your Website Needs HSTS in 2026

One header, one config line, and downgrade attacks stop reaching your users. If your site doesn't ship HSTS in 2026, you're leaving free security on the table.

Read

headers

How to Roll Out CSP in Report-Only Mode

CSP is one of the most effective XSS defenses ever shipped — and one of the most feared to deploy. Report-only mode turns a scary launch into a boring one.

Read

dns

DMARC in Plain English

SPF, DKIM, DMARC. Three DNS records, one goal: stop other people from sending email as you. Here is what each one actually does.

Read

More tools

Tool

security.txt Checker

Confirm security researchers can reach you.

Read