--- title: DNS Health Checker — DNS Health Grade A+ to F description: Grade a domain's DNS A+ to F: how many nameservers it has and on which networks, lame delegation, whether the registry and the zone agree, SOA serials, DNSSEC and CAA, with the fix for every problem. Then see what every probe location answers, on a map. canonical: https://watchfor.io/dns-health-checker --- # DNS Health Checker ## DNS Health Checker Grade a domain's DNS A+ to F: nameservers and their networks, delegation, SOA, DNSSEC and CAA, with the fix for every problem. Then see what every probe location answers. ### What every location answers ( A ) The same record asked from every probe location at once. A location that disagrees with the rest is a stale cache or a nameserver serving old data. Loading prober map… Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## The DNS health grade scale Every check grades the zone : the delegation, every nameserver asked directly, the SOA, DNSSEC and CAA — read from your nearest probe location — plus how consistently the record answers from every location on the map. If we could not reach the nameservers from our side, there is no grade. A+ Excellent At least two nameservers on separate networks, every one answering authoritatively with the same serial, the parent zone and the zone agree, DNSSEC validates, CAA is published and every location sees a consistent answer. A Good Healthy, one step short of A+: usually no DNSSEC or no CAA record, all nameservers on one provider's network, an unusual negative-caching TTL, or a record still propagating. B Needs attention A real weakness: nameservers out of sync, the parent and the zone list different nameservers, all nameservers in one /24, a nameserver that does not answer, or several locations that cannot resolve the record. C Weak A lame nameserver — listed, but refusing or not answering authoritatively for the zone — or only one nameserver. F Failing The domain does not resolve, or DNSSEC is broken so validating resolvers (Google, Cloudflare, Quad9 and most ISPs) refuse to answer. ## Every rule, in full The grade starts at A+ and each problem can only lower the ceiling, so the grade is always explained by the worst finding in the report. Rules version dns-2026.10b . Grade at most When F The domain does not resolve and no nameserver answers authoritatively F DNSSEC is bogus: a DS record at the parent, but signatures that do not validate (resolvers return SERVFAIL) C A lame nameserver: listed, but it refuses, fails or answers without authority for the zone C Only one nameserver B A nameserver that does not answer from our location while the others do B SOA serial differs between nameservers of the same network (several DNS providers numbering the zone independently are reported, not graded) B The parent zone and the zone itself list different nameservers B Every IPv4 nameserver address sits in one /24 B Propagation: 2 or more locations (or 20 %) cannot resolve the record while most can A Every nameserver on one network (ASN). Anycast providers often do this, so it only costs A+ A DNSSEC not enabled (no DS at the parent), or keys published without a DS A No CAA record limits which CAs may issue certificates A Negative-caching TTL (SOA minimum) outside 300 s – 1 day A Propagation: locations disagree on an NS, MX, TXT or CNAME answer (still propagating) — SOA refresh / retry / expire outside the RFC 1912 ranges (they only matter to secondaries that pull the zone by transfer) — NS TTL under 5 minutes or over 2 days; one location that cannot resolve; A / AAAA answers that differ by region (normal for CDNs and GeoDNS) [How WatchFor grades everything the same way](/grades#dns-health) Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) ## What is DNS Health Checker ? A DNS health check asks a simple question: if one part of your DNS fails, does your domain keep working? Most DNS problems are invisible on a normal day. A second nameserver that stopped answering months ago, a registrar that still lists an old provider, a DNSSEC key that will break the day it rolls — the site loads fine until the one remaining server has a bad hour, and then everything that depends on the name is down at once: the website, the API, the mail. This DNS checker grades a domain's DNS from A+ to F and tells you why. From your nearest probe location it reads the delegation at the registry, asks every nameserver directly whether it really serves the zone and which version it has, and checks the SOA record, DNSSEC and CAA. Then it asks every probe location for the record you picked, so a DNS test from one place is not mistaken for the whole picture. Every problem it finds comes with the fix, in plain words. The letter is on the same WatchFor Grade scale as the SSL/TLS, email and mail server grades: it starts at A+, each problem can only lower it, and the worst one decides. The rules are published in full on this page, with the highest grade each problem allows. ## How it works One check runs two things in parallel: - 1 Read the delegation — We ask the parent zone (for example.com , the .com registry) which nameservers it hands out for your domain, with their glue addresses. That list is what the world uses to find you — not what your DNS provider's dashboard says. - 2 Ask every nameserver directly — Each nameserver, on each of its addresses, gets a non-recursive query for the SOA and NS records. We note whether it answers with authority, which SOA serial it has, how fast it replied and which network (ASN) the address belongs to. - 3 Check DNSSEC and CAA — A validating resolver tells us whether the parent publishes a DS record, whether the zone has DNSKEYs, and whether its signatures actually validate. A CAA lookup shows which certificate authorities may issue for the domain, if any. - 4 Ask every location — In parallel, every active probe location resolves the record you chose (A by default) through its own resolver. A record that fails in several places, or an NS / MX / TXT answer that differs by location, shows up here and nowhere else. - 5 Grade it — Those facts go through the published rules (rules version dns-2026.10b ). The grade, the list of findings with fixes, the nameserver table and the zone details come first; the per-location table and map follow as the evidence. The whole check usually takes a few seconds. It uses the same allowance as the DNS Propagation Checker, because it is the same check: one page leads with the grade, the other with the map. ## When you'd use it ### After moving DNS to a new provider The new provider's dashboard looks right, but the registrar may still list one of the old nameservers. The nameserver check here compares the registry's list with the zone's own NS records and asks every one of them directly, so a forgotten server shows up as a mismatch or a lame nameserver. ### Before a security review or a customer questionnaire "Do you use DNSSEC?", "Do you restrict certificate issuance?", "Is your DNS redundant?" One check answers all three with evidence: the DNSSEC check, the CAA record and the nameserver networks, each graded. ### When a site works for some people and not others One lame nameserver means a share of lookups fail or wait for a timeout, depending on which server a resolver tries first. The per-nameserver table shows which one is not answering, and the location map shows whether the failures are regional. ### Turning DNSSEC on (or off) safely DNSSEC breaks loudly when the DS record at the registrar and the keys in the zone stop matching: validating resolvers return SERVFAIL and the domain disappears for a large part of the internet. Run the check after every change to the keys or the registrar. ### A quick DNS test for a domain you don't run Evaluating a vendor or onboarding a customer domain? The grade is a fast, honest read of how carefully the DNS is run, from public data only. ## Reading the result ### The grade A+ : at least two nameservers on separate networks, all answering with authority and in sync, the registry and the zone agree, DNSSEC validates, CAA is published and every location resolves the record. A : healthy but one step short — usually no DNSSEC, no CAA, or every nameserver on one provider's network. B : a real weakness, such as a nameserver that does not answer, serials out of sync within one provider, or the registry and the zone listing different nameservers. C : a lame nameserver, or only one nameserver. F : the domain does not resolve, or DNSSEC is broken. No letter means we could not measure from our side, never a verdict on your domain. ### Findings and fixes Each finding names the problem, shows the highest grade it allows, and says what to change. The first finding in the list is the one that set the letter. Notes marked as info are worth knowing but do not lower the grade. ### Nameservers One row per nameserver address: whether it answered with authority, its SOA serial, how long it took and the network it sits on. Two addresses on the same network count once for redundancy, because one outage at that network takes both down. ### Zone: SOA, DNSSEC, CAA The SOA timers (refresh, retry, expire and the negative-caching TTL), the DNSSEC state — not signed, signed and valid, or bogus — and the CAA records that limit which authorities may issue certificates for the domain. ### What every location answers Below the grade: the same record asked from every probe location, as a table and a world map. Different A or AAAA answers by region are normal for CDNs and GeoDNS. A location that cannot resolve the record at all, while the others can, is the one to look at. ## Check it yourself The registry's list, then each nameserver asked directly, then DNSSEC: dig NS example.com @a.gtld-servers.net +norecurse dig SOA example.com @ns1.example.net +norecurse +short dig DS example.com +short The first line's AUTHORITY section is the registry's nameserver list ( a.gtld-servers.net serves .com ; use your TLD's servers). Repeat the second line for every nameserver: each should answer with the same serial. An empty DS answer means DNSSEC is not enabled at the registry. ## Common pitfalls ### "My DNS provider says everything is fine" Your provider sees its own servers. The registry may still point at servers you no longer run, and those are what resolvers use. Fix the nameserver list at the registrar so it matches the NS records in your zone exactly. ### Two nameservers that are really one ns1 and ns2 on the same network, or in the same /24, fail together. Real redundancy means different networks — a second provider, or a provider whose nameservers sit on separate networks. ### Enabling DNSSEC at the provider but not the registrar Signing the zone does nothing until the DS record is published at the registrar; until then the grade shows keys without a DS. The reverse is worse: a DS left behind after moving to an unsigned provider makes the domain fail for every validating resolver. Remove the DS first, then move. ### Different SOA serials across providers If you run two DNS providers side by side, each one numbers the zone its own way, so their serials never match. That is reported as information, not graded. What matters is that both serve the same records. ## Run DNS Health Checker on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What does this DNS health check test? Nameserver count and network diversity (ASN and /24), whether each nameserver answers with authority, SOA serial sync, the delegation at the registry versus the NS records inside the zone, SOA timers, DNSSEC (not signed, valid, or broken), CAA, NS TTL, and whether the record you chose resolves from every probe location. How is the grade calculated? Every domain starts at A+. Each finding caps the grade at the highest letter it allows — a lame nameserver at C, out-of-sync serials within one provider at B, no DNSSEC at A — and the worst finding wins; nothing adds points back. Its rules version ( dns-2026.10b ) is shown with every result. Why does my domain on a big DNS provider get A, not A+? Usually DNSSEC is not enabled, there is no CAA record, or every nameserver is on one provider network. Large anycast providers are very resilient, so one network only costs the step from A+ to A, but the provider is still one point of failure. Each shows up as a finding with the fix. Is a DNSSEC check enough to know DNSSEC works? Only if it validates, which is what we check: a DS at the registry, keys in the zone, and signatures a validating resolver accepts. A DS whose signatures do not validate is graded F, because validating resolvers then refuse the domain entirely. Keys without a DS at the registry are graded A: signed, but nobody checks the signatures yet. How is this different from the DNS Propagation Checker? It is the same check and uses the same allowance. The [DNS Propagation Checker](/dns-propagation-checker) leads with the world map and is for "has my change reached everyone yet?"; this page leads with the grade and is for "is my DNS set up well?". Both show everything. Is this an alternative to the MxToolbox DNS check? Yes. You get a single A+ to F grade with the rule behind each finding, every nameserver asked directly, DNSSEC and CAA, and the record checked from every probe location at once. No signup, and the rubric is public. Why is there no grade for my domain? Because we could not measure it honestly: the zone checks did not run from our location, every nameserver timed out from our side while the domain still resolves (a network path problem, not your DNS), or the domain is not delegated at all. We never turn our own network trouble into a bad grade for you. Run the check again in a minute. Can I check an IP address or a subdomain? A subdomain, yes: the zone it belongs to is graded and the record is resolved for the name you typed. An IP address has no zone to grade, so you get the propagation answers without a letter. Can I get alerted when my DNS breaks? Yes. A WatchFor [DNS monitor](/dns-monitoring) checks a record on a schedule from the locations you choose and alerts when the lookup fails or the answer stops matching what you expect. This page is the one-off check. ## Related dns tools - [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map — plus an A+ to F DNS health grade for the zone: nameservers, delegation, DNSSEC and CAA.](/dns-propagation-checker) - [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.](/dns-checker) - [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.](/whois-lookup) - [A Record LookupFind the IPv4 address a domain resolves to — every A record, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short.](/a-record-lookup) --- Canonical page: https://watchfor.io/dns-health-checker · Site guide: https://watchfor.io/llms.txt