5 of 7 things we check
DNS
Your domain's address-book settings, like DNSSEC and any alias at your domain or www that points nowhere, and when it's due for renewal.
What we look at
- No alias to nowhere. If your domain or www is an alias (a CNAME) for another name, that name still exists. If it doesn't, that's a Medium problem: a sign of old settings worth tidying up.
- More than one nameserver. Two or more, so your domain keeps answering if one has trouble. Only one is a Low problem.
- DNSSEC. A signature on your DNS answers that makes them harder to fake. Not having it earns a Note. Having it half set up is a High problem, because it can stop your domain working for some visitors.
- CAA records. Whether you've named which authorities may issue certificates for your domain. Never changes your score.
- www is set up. Whether the www version of your address has DNS records too. Never changes your score.
- Public addresses only. Your domain points only at addresses on the public internet. Never changes your score.
- Registration renewal. When your domain registration runs out. 30 days or fewer is a Medium problem and a week or less is a High one. It never changes your score: it's about keeping your domain, not how it's set up.
Why it matters
DNS is the internet's address book. It sends visitors to your website and email to your inbox.
Most of the time it just works, which is why it's easy to forget. An old alias, a single nameserver or a registration that quietly runs out can all cause trouble long after anyone remembers setting them up.
In our sample report
Here's this part of our sample report for a demo website. example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.
Sample report · example.com · illustrative data
DNS
100 out of 100. 7 of 7 checks completed
5 passed · 2 notes
-
Passed Stale DNS alias
example.com has no dangling CNAME
-
Passed Nameserver redundancy
example.com has redundant nameservers
-
Note DNSSEC
DNSSEC is not enabled for example.com
-
Note CAA records
example.com has no CAA records
-
Passed www host
www.example.com resolves
-
Passed Public addresses
example.com resolves only to public addresses
-
Passed Domain registration expiry
example.com's registration is not expiring soon
Who fixes it
In your report, anything to fix in this area goes to:
- Your DNS provider: Stale DNS alias, Nameserver redundancy, DNSSEC, CAA records, www host, Public addresses.
- Your domain registrar: Domain registration expiry.
What we can't see from outside
We see the same public DNS answers any visitor's computer gets. We look up your domain, its www address, the email settings kept under your domain and any names your SPF record points to. We never guess names. For DNSSEC we check that the pieces are published, not the signatures themselves.
The registration date comes from one look-up with your domain's registry. If the registry doesn't give one, that check shows Not checked.