dotvitals

DNS Health Checker

Audit a domain's DNS configuration for missing records, delegation problems and common misconfigurations.

Try

Fix it here

These build the changes the checks above ask for, and validate them against the same rules.

SOA record fix-builder

Build a correct SOA record for your zone — the four timers that decide how quickly your backup nameservers notice a change, and how long the internet remembers that a name does not exist.

The SOA sits at the top of a zone, so this has to be the exact name your nameservers are authoritative for. Naming a subdomain that is not a zone of its own produces timers nothing ever reads.

Nameserver delegation fix-builder

Publish one nameserver set in all three of the places it lives — the registry (through your registrar), your own zone, and the glue records at the parent — and see which of them your DNS host cannot touch.

The delegation lives at the parent, so we need the name that was actually delegated — the one you registered, or the subdomain if that is the part with its own nameservers. Aim this at the wrong name and the records go somewhere nobody looks.

Authoritative nameserver configuration builder

Close an open zone transfer, turn off recursion and make TCP port 53 reachable — as configuration for the nameserver you actually run, or as the message to send the provider who runs it for you.

The configuration names the zone in its transfer and recursion rules, so it has to match the zone the nameserver really serves. A mismatch leaves the open transfer you came here to close exactly where it was.

Address record builder

Publish the A and AAAA records that make a name resolve, with the addresses that must never be published refused before you can copy them.

This is the zone the record is published in — the domain you can log in and edit DNS for. The exact name it answers at, bare or a subdomain, is the next question.

About the dns health checker

A DNS health check looks past individual record values and examines whether the zone as a whole is configured correctly. It checks that every name server listed at the registrar actually answers for the zone, that they agree with each other, and that the SOA record's serial number and timers are sane, since a stale serial can leave secondary servers serving an outdated copy of the zone.

Common problems it surfaces include lame delegation, where a name server is listed but does not actually host the zone; missing glue records for name servers hosted inside the domain itself; and a single point of failure where all name servers sit behind one provider or one network, so one outage takes the whole domain offline. It also flags basic hygiene issues: an apex A or AAAA record pointing at an address that does not respond, a missing MX record when the domain clearly sends mail, or NS records at the registrar that do not match the NS records inside the zone, which confuses resolvers about which servers are actually authoritative.

It also checks the things a zone can get wrong that have nothing to do with the records in it. Whether every authoritative server answers over TCP on port 53, which resolvers fall back to whenever an answer is too large for a single UDP packet, so a firewall blocking it causes intermittent failures that look like nothing at all. Whether a server allows a full zone transfer to anyone who asks, handing over your entire zone including internal hostnames. Whether an authoritative server is also answering recursive queries for strangers, which makes it usable in amplification attacks. And whether the SOA timers are sane: refresh between twenty minutes and twelve hours, retry shorter than refresh, expire of two to four weeks, and a negative-cache minimum between five minutes and an hour.

None of these problems are visible from a single record lookup; they only show up when the whole delegation chain and all authoritative servers are checked together and cross-referenced, which is what this tool automates. These issues rarely trigger an obvious outage on their own, which is exactly why they tend to go unnoticed until a migration, a provider switch, or a spike in traffic exposes the gap.

Common questions

What does 'lame delegation' mean?
It means a name server is listed as authoritative for a domain at the registrar but does not actually respond authoritatively for that zone, usually because it was removed from the DNS provider without updating the registrar.
Why do my name servers need to agree?
Resolvers pick any name server from the list at random. If they return different data for the same query, some visitors will see stale or inconsistent answers depending on which server they happened to ask.
Is one DNS provider enough?
It works, but it is a single point of failure. Using a secondary provider with a different network means a full outage at one provider does not take your domain offline.
What is glue?
An A or AAAA record for a name server that is itself inside the domain it serves, published directly at the parent zone so resolvers can find it without a circular lookup.
Why does DNS need TCP as well as UDP?
An answer too large for a UDP packet is returned truncated, and the resolver retries the same query over TCP on port 53. A firewall that allows UDP and blocks TCP therefore breaks large answers only, which looks like an intermittent fault rather than a blocked port.
Why is an open zone transfer a problem?
A zone transfer hands over every record in the zone at once, including internal hostnames, staging systems and anything else you did not intend to publish as a list. Restrict transfers to your own secondary servers.
How many name servers should I have?
At least two, which is both the long-standing recommendation and something every registry checks. Two that share one address or one network give you the count without the redundancy, so the useful target is two that can fail independently.
What this tool checks (20 rules)
  • dns.health.cname-with-other-data — A name has a CNAME alongside other records
  • dns.health.glue-mismatch — A glue record's address does not match the nameserver's own
  • dns.health.glue-missing — A nameserver inside the domain has no glue record
  • dns.health.lame-delegation — A nameserver you delegate to does not answer for the zone
  • dns.health.ns-count-below-2 — The domain has fewer than two nameservers
  • dns.health.ns-is-cname — A nameserver name is an alias rather than a host
  • dns.health.ns-parent-child-mismatch — The registry and the zone disagree about the nameservers
  • dns.health.ns-single-address — All nameservers resolve to one address
  • dns.health.ns-single-netblock — All nameservers sit in one network block
  • dns.health.ns-unresolvable — A nameserver name has no address
  • dns.health.probe-unavailable — The delegation could not be checked
  • dns.health.recursion-open — A nameserver answers queries for domains that are not yours
  • dns.health.serial-mismatch-across-ns — Your nameservers are serving different versions of the zone
  • dns.health.soa-expire-out-of-range — The SOA expire interval is outside the usual range
  • dns.health.soa-minimum-out-of-range — The SOA negative-caching TTL is outside the usual range
  • dns.health.soa-missing — The zone has no readable SOA record
  • dns.health.soa-refresh-out-of-range — The SOA refresh interval is outside the usual range
  • dns.health.soa-retry-out-of-range — The SOA retry interval is outside the usual range
  • dns.health.tcp53-unreachable — A nameserver answers over UDP but not over TCP
  • dns.health.zone-transfer-open — A nameserver hands out the whole zone to anyone who asks