DNS check: test your domain's setup
Enter a domain name and see what its nameservers actually say: delegation, SOA, mail, DNSSEC — with the problems and what to do about them.
What the DNS check covers
- Delegation
- Whether the parent zone (for example .hu or .com) points to the right nameservers, and whether the glue records are in place.
- Nameservers
- Whether every nameserver answers, answers authoritatively, returns the same data as the others, and is reachable over IPv6.
- SOA record
- The zone's serial number and timers, and whether all nameservers carry the same version of the zone.
- Mail (MX)
- Whether the mail servers resolve, are reachable from the internet and have reverse DNS.
- SPF and DMARC
- Whether the domain is protected against forged sender addresses, which also decides how reliably your own mail is delivered.
- DNSSEC and CAA
- Whether the zone is signed, the DS record at the registry matches the key, and which certificate authorities may issue certificates.
- Website addresses
- Where the domain and its www name point, including whether they sit behind Cloudflare or resolve to a private address.
Frequently asked questions
Is the DNS check free?
Yes. It needs no registration, and you can check any domain, not only those hosted at aWh. To keep the service fast for everyone, one visitor can start up to ten new checks a minute.
How is this different from an ordinary DNS lookup?
The check asks the domain's authoritative nameservers directly, one by one, instead of relying on a cached answer. That is how it finds problems an ordinary lookup hides, such as one nameserver serving an outdated zone.
I changed a record. Why do I still see the old value?
Resolvers keep an answer for as long as its TTL allows, so a change can take from a few minutes to a day to reach everyone. The zone check reads the authoritative servers, so it normally shows the new value at once; the record lookup shows what a public resolver currently has cached.
Why does mail from my domain land in spam?
The usual causes are a missing or too permissive SPF record, no DMARC record, or a mail server without reverse DNS. The check reports each of these.