Domain Health Report Card
A-F grade for DNS, email auth and HTTPS setup with fixes
About Domain Health Report Card
Domain Health Report Card
This tool runs eleven checks on a domain's DNS, email authentication and HTTPS setup, marks each PASS, WARN or FAIL with the reason and how to fix it, and turns the result into a grade from A to F. All checks run in parallel and the report finishes in under 20 seconds.
What It Checks
| Check | Points | PASS when |
|---|---|---|
| Name servers | 10 | At least two NS records, and every tested server answers authoritatively for the zone |
| SOA record | 5 | Refresh 1200-86400 s, retry below refresh, expire 1-4 weeks, negative TTL 60-86400 s |
| DNSSEC | 8 | DS record at the parent and answers validate (AD flag from a validating resolver) |
| MX records | 5 | MX records present, or a null MX for a domain that takes no mail |
| SPF | 10 | Exactly one v=spf1 record, ending in -all or ~all, needing 10 DNS lookups or fewer |
| DMARC | 12 | p=quarantine or p=reject applied to 100% of mail |
| CAA | 5 | CAA records restrict which CAs may issue certificates |
| HTTPS certificate | 20 | Trusted certificate for the name with more than 21 days left |
| HTTP to HTTPS redirect | 10 | http:// ends up on an https:// URL |
| HSTS | 10 | Strict-Transport-Security with max-age of at least six months |
| IPv6 | 5 | The website name has an AAAA record |
How the Grade Is Calculated
A PASS earns the check's full points, a WARN half, a FAIL none; the points add up to 100. A is 90 or more, B 80-89, C 70-79, D 60-69 and F below 60. A check that times out counts as WARN, so a slow name server costs points but never fails the whole report.
If the bare domain has no website, the web checks use www. instead, and the report says so.
Common Problems
- SPF over 10 lookups: every include:, a, mx, ptr, exists: and redirect= costs a DNS lookup, including those inside included records. Past 10, receivers treat SPF as a permanent error. Remove unused includes or switch to ip4:/ip6: ranges.
- DMARC p=none: good for collecting reports, but spoofed mail still gets delivered. Move to quarantine, then reject, once your legitimate senders pass.
- No HTTP redirect: visitors who type the bare name land on plain HTTP. Redirect with a 301, then add HSTS so browsers go straight to HTTPS next time.
- Certificate about to expire: automate renewal with ACME. Certificate lifetimes are getting shorter every year.
For the full record-by-record view, run the DNS checker; for email details, see MX records and the SPF tools.