Skip to content
dnsdon

Free · Read-only · No sign-up

Find out why a domain isn't working.

Find out why email lands in spam, when a certificate will expire, and whether DNS is set up right. Every finding shows the evidence behind it and what to do next.

What do you want to check?
Try: dnssec-failed.org expired.badssl.com google.com 127.0.0.2

DNSSEC validation fails

dnssec-failed.org

Example
  • 2 Fail
  • 3 Pass
  • 1 Info
  • Fail

    DS ↔ DNSKEY match

    Parent DS key tag 42069 — no DNSKEY with this tag is served by the zone.

  • Fail

    Validation by public resolvers

    SERVFAIL from 1.1.1.1 and 8.8.8.8; data returned with checking disabled.

  • Pass

    Key consistency

    All 5 nameservers serve the same DNSKEY set.

Excerpt from a DNSSEC report for a public test domain. Run it live

One path, six layers

A domain works in layers. Check each one.

From the registry's delegation to the certificate a browser sees and the policies mail servers check. When you're not sure where a problem starts, work along the path.

01 · Registry

Registrar & Nameserver Check

Are your nameservers set and answering?

Open tool
02 · Records

DNS Record Inspector

What your zone actually serves, and for how long.

Open tool
03 · Signatures

DNSSEC Chain Validator

Will validating resolvers trust your answers?

Open tool
04 · Caches

DNS Propagation Checker

Who still has the old answer after a change.

Open tool
05 · Web

SSL Certificate Checker

Expiry, trust and HTTPS, before visitors see an error.

Open tool
06 · Mail

Email Authentication Checker

Whether inboxes believe your mail is really yours.

Open tool

Email deliverability

Emails landing in spam? Find out why, and how to fix it.

Inboxes rarely tell you why they filtered a message. It almost always comes down to one of two things, and both can be checked from the outside in under a minute.

  1. Your mail server is on a blacklistOne hacked mailbox or abused form is enough. Filters then reject or quarantine everything that server sends. We check the 11 lists that actually block mail, including Spamhaus and SpamCop, instead of a hundred that almost no mail provider uses, and link straight to each removal page.
  2. Your domain can't prove the mail is yoursGmail, Yahoo and Outlook require SPF, DKIM and DMARC from bulk senders. A broken include or missing key quietly fails all three.
Check blacklists Check SPF, DKIM and DMARC

Blacklistings happen without warning. Pro checks every hour and emails you the moment you're listed.

Why example.com mail lands in spam

2 blacklist listings · 1 authentication warning

Example
203.0.113.25 · Mail serverListed on 2 of 8
  • SpamCop : Fail
  • UCEPROTECT : Warning
  • Spamhaus ZEN : Pass
  • Mailspike : Pass
  • PSBL : Pass
  • DroneBL : Pass
  • GBUdb : Pass
  • SPFBL : Pass
example.com · DomainClean on all 3
  • Spamhaus DBL : Pass
  • SURBL : Pass
  • URIBL : Pass
  • Pass

    SPF and DKIM

    Both pass for the domain's mail provider.

  • Warning

    DMARC

    p=none: reports only, so spoofed mail is still delivered.

Example diagnosis of a mail server with a SpamCop listing.

DNS propagation

Changed a record? See who still has the old one.

Nothing is pushed out when you change DNS. Each resolver keeps serving the answer it cached until that copy expires, so the change appears at different times for different people.

The propagation check asks eight public resolvers, compares each answer with your nameservers, and shows how long each cached copy has left.

Planning a change? Lower the TTL a day ahead and this window shrinks from an hour to minutes.

Check propagation

2/8 resolvers have the new answer

30 min after the change · TTL 1 hour

Example
Cloudflare Switches after 54 minutes Old
Google Public DNS Switches after 47 minutes Old
Quad9 Switches after 58 minutes Old
OpenDNS Switches after 20 minutes New
AdGuard DNS Switches after 40 minutes Old
Control D Switches after 49 minutes Old
Yandex DNS Switches after 11 minutes New
AliDNS Switches after 33 minutes Old
Each bar is how long a resolver keeps the old answer it cached before the change. When it expires, the next lookup fetches the new record.

Evidence first

No guesswork, no false alarms

A timeout is not proof that a server is down, and a missing record is not always a mistake. Reports keep what was observed separate from what it probably means, and say so when the evidence isn't enough.

How the checks work
Pass
The check succeeded based on the observed responses.
Warning
Works now, but is risky, unusual or worth reviewing.
Fail
A problem was observed directly in the responses.
Inconclusive
Not enough evidence — for example a server did not respond.

Reproducible

With Pro, every query comes with its dig equivalent

$ dig @1.1.1.1 dnssec-failed.org DNSKEY +dnssec

Learn

Guides

Practical explanations of the concepts behind each check.

All guides

Something broken right now?

Run every check at once. Then let monitoring tell you the next time something breaks.

Run a check Monitor a domain free