Domain Health Check

About the domain health check

A domain touches many independent systems: DNS, mail authentication, TLS certificates, and the web server's own headers, and a weakness in any one of them can undermine security or deliverability even if the others are configured perfectly. This tool runs the full set of individual checks against a domain in one pass and reports the results together instead of one tool at a time.

Checks cover DNS records, zone health, DNSSEC and propagation; domain registration, locks and expiry; the full email set — MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, SMTP TLS, reverse DNS and public blocklists; the TLS certificate chain and supported protocols; HTTP reachability, redirects and transport headers; security headers, cookies and CORS; exposed ports; search-engine metadata and crawlability; and page performance. Every one of these also has a tool page of its own, so a single area can be re-checked without re-running everything; what the full scan adds is the cross-referencing, one grade covering all of it, and the checks you would not have thought to run.

Each category starts at a baseline score and loses points for failing rules, weighted by how serious that particular failure is; a missing DMARC record, for instance, deducts more than a missing but non-critical security header. Several things that other scanners report as failures deduct nothing here, on purpose: an unsigned zone, an IPv4-only domain, an absent CAA record and a site with no field performance data are all reported as information, because none of them is a fault. The overall grade is a weighted average across categories, and the exact scoring rules are published and versioned so the number is not a black box.

Where a check could not run, the report says so and scores nothing for it, rather than filling the gap with a pass. The port scan and the TLS protocol enumeration need an external probe host; when it is not connected, those sections say they were not tested and name the reason. A category cannot reach a perfect score on the strength of checks that never ran.

Because it is a single scan rather than a manual sequence of separate lookups, this is the fastest way to get an accurate overall picture of a domain's configuration, and the results link through to each specific finding's own checker page when you need to dig into a particular failure in detail. Because every category is scored against the same public rule set on every run, results are also directly comparable over time, which makes the tool useful not just for a one-time audit but for tracking whether changes actually improved the domain's configuration.

Common questions

What does the health check test?

DNS records, zone health, DNSSEC and propagation; registration and expiry; MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, SMTP TLS, reverse DNS and blocklists; TLS certificate and protocols; HTTP reachability, redirects and headers; security headers, cookies and CORS; open ports; SEO metadata; and performance. All in one scan.

What happens if part of the scan cannot run?

That part is reported as not tested, with the reason, and it scores nothing. A failed module never fails the whole report, and it never quietly becomes a pass either.

How is the score calculated?

Each category starts at a baseline and loses points per failing rule, weighted by severity. The overall score is a weighted average across categories, and the scoring specification is published and versioned.

Do I need an account?

No. Reports are free and anonymous, and a shareable link to the results stays valid for a limited retention window.

How is this different from running each checker separately?

It runs every check in one pass and combines the results into a single grade and fix list, instead of requiring you to visit each individual tool and mentally combine the findings yourself.