Reads public registry and DNS data only: dates and locks from the registry, then nameservers, SPF, DMARC, DNSSEC, CAA and domain blocklists from DNS. DKIM is found by trying common selector names, so “not found” is not proof. A good grade means the common basics are in place, not that the domain is secure, and we do not test whether mail is delivered.
Tool 14 / 18
Domain Health Check
A quick check-up for a domain you own or want to buy: when it expires, whether it is locked, whether its DNS and email authentication are set up, and whether it is on a blocklist.
Questions about the Domain Health Check
What does the domain health check test?
When the domain expires, whether the transfer lock is on, DNS records, email security (SPF and DMARC), and whether it is listed on a domain blocklist.
What are SPF and DMARC?
SPF lists the servers allowed to send email for your domain. DMARC tells receivers what to do with mail that fails SPF or DKIM checks and where to send reports. Together they reduce spoofing.
Can I be told if a domain I want expires and drops?
Yes. Press Watch a name, enter the name and your email, and we email you when it becomes available. One name is free; Pro subscribers can watch up to 50, also get a heads-up when a name is about to be released, and receive both alerts on Telegram if they connect it.
Is this a security audit?
No. It reads public registry and DNS data and is a quick check-up, not a security audit.
Terms used on this page
- Registrar A registrar is a company accredited to sell domain names and manage them for you, such as GoDaddy or Namecheap. You register and renew a domain through one.
- Registry A registry is the organisation that runs one top-level domain and keeps the master database of its names. Verisign is the registry for .com.
- Expired domain An expired domain is a name whose registration period ended without being renewed. It is not released at once: it passes through several grace periods first.
- Auto-renew grace period The auto-renew grace period is the time just after a domain expires, typically up to about 45 days, when the owner can still renew it at the normal price.
- DNS (Domain Name System) DNS is the internet's phone book: it turns a domain name into the addresses and settings that browsers and mail servers need to reach it.
- Nameserver A nameserver is a server that holds a domain's DNS records and answers questions about it. A domain lists at least two so one can fail.
- DNS provider A DNS provider is the company that runs the nameservers for a domain. It is often, but not always, the registrar or the web host.
- SPF record An SPF record is a DNS entry that lists the servers allowed to send email for a domain, so receivers can spot mail that is faked.
- DKIM DKIM adds a digital signature to outgoing email, checked against a public key published in the sender's DNS, so receivers can tell the message was not altered.
- DMARC DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF or DKIM checks, and where to send reports about it.
- Transfer lock A transfer lock is a setting at the registrar that stops a domain from being moved to another registrar without the owner's approval.
- RDAP RDAP, the Registration Data Access Protocol, is the standard way to look up whether a domain is registered and its status. It replaced WHOIS.
- WHOIS WHOIS is the older lookup service that shows who registered a domain and when. Since 2018 much of the personal data it showed is hidden, and RDAP replaces it.
- Domain blocklist A domain blocklist is a list of domain names reported for spam, phishing or malware, used by mail and security systems to block or flag them.