Free DNS Health Checker
One of the free tools from KinetixSEO, an SEO and AI-citation (GEO) checker. Check any domain's email authentication (SPF, DKIM, DMARC), DNSSEC signing, and IPv4/IPv6 reachability — the DNS misconfigurations that quietly undermine domain trust and deliverability.
What you'll get
Results for
example.com
Email authentication
- SPF
- Present
- DMARC
- Present but not enforced (p=none)
- DKIM
- Present
- MX records
- Present
Security & reachability
- DNSSEC
- Not signed
- IPv4 / IPv6
- Dual-stack
What the Free DNS Health Checker checks
- SPF record presence and validity
- DKIM record presence
- DMARC record presence and policy strength (none/quarantine/reject)
- Nameserver configuration and redundancy (multiple NS records)
- MX record presence for domains that receive mail
- Common misconfigurations — e.g. multiple SPF records, which email providers treat as a hard fail
Frequently asked questions
What do SPF, DKIM, and DMARC actually do?
SPF (Sender Policy Framework) publishes a TXT record listing which mail servers are allowed to send email as your domain — receivers that see mail from an unlisted server can reject or flag it as spoofed. DKIM (DomainKeys Identified Mail) cryptographically signs outgoing mail with a private key so the receiving server can verify, via a public key published in DNS, that the message wasn't altered in transit and really came from your infrastructure. DMARC (Domain-based Message Authentication, Reporting & Conformance) sits on top of both: it tells receivers what to do when a message fails SPF or DKIM checks — and, critically, without DMARC a domain has no policy at all, so failing SPF or DKIM checks often has no real consequence for a spoofer. Together the three make it much harder for someone to send phishing email that appears to come from your domain, which is a major reason inboxes and spam filters weigh their presence heavily.
Why does having two SPF records break things instead of adding coverage?
RFC 7208 (the SPF specification) permits only one SPF TXT record per domain. If a mail server or provider adds a second `v=spf1` TXT record — a common mistake when migrating providers or adding a new sending service without checking for an existing one — most receiving mail servers treat this as a PERMERROR and can hard-fail the entire domain's SPF check, meaning even genuinely authorized senders start getting rejected or sent to spam. The fix is always to merge every sending source into one SPF record with `include:` mechanisms, never to add a second record alongside the first.
What do the DMARC policy levels (none, quarantine, reject) mean?
DMARC's policy (p=) tag controls what a receiver does with mail that fails authentication. `p=none` only requests monitoring reports — it identifies problems but doesn't block a single spoofed message, so a domain can have DMARC "present" while offering zero real protection. `p=quarantine` asks receivers to route failing mail to spam/junk instead of the inbox. `p=reject` asks receivers to refuse failing mail outright, which is the fully enforcing setting. Most domains that publish DMARC start at `p=none` to observe traffic safely, then move to quarantine and eventually reject once they've confirmed all legitimate senders pass — a domain stuck at `p=none` for months is a common sign the rollout was started and never finished.
Why does nameserver redundancy matter?
Your domain's nameservers (NS records) are the servers the entire internet asks when it needs to resolve your domain to anything — mail routing, website IPs, every other DNS record. If a domain has only one nameserver, or all its nameservers sit behind a single provider with no geographic or network diversity, an outage or DDoS attack against that one point of failure can make the domain completely unreachable — no mail delivery, no website, nothing resolves. The standard recommendation is at least two nameservers, ideally from providers or network paths that don't share a single point of failure.
What doesn't this DNS health checker do?
This tool reads your domain's current DNS records and reports what it finds right now — it does not monitor your DNS for changes over time or alert you if a record breaks or gets removed later, and it does not send test email or verify actual mail delivery and inbox placement (a technically correct SPF/DKIM/DMARC setup can still land in spam for reasons this check can't see, like sender reputation or content filtering). It's a one-time configuration snapshot, not an ongoing monitoring or deliverability-testing service.
Go deeper
This free check looks at one signal in isolation. KinetixSEO's paid report combines every signal below into one prioritised fix list and tracks it over time.
See the full paid report for this →This is one check from KinetixSEO's full SEO/GEO audit. Want the complete picture — Core Web Vitals, AI-citation readiness, technical SEO health, and tailored fixes? Run the free full checker.