Domain check
One report on a domain: whether the website's certificate is valid, whether someone can send email pretending to be you, and whether the DNS basics are in place. Where something needs fixing, it gives you the record to paste.
What the check looks at
A domain health check for the three things that break quietly and cost a small business when they do. Each one is the same check the full tool runs, reduced to the question you would actually ask.
- The website certificate. It connects to your site the way a browser does and reports whether the certificate is trusted, matches the name and has time left. The SSL checker has the full chain.
- Email security. It reads your SPF, DKIM and DMARC records and says whether a fake message from your domain would be delivered, which is what an email spoofing check tests. The email checker shows every record and the SPF lookup chain.
- DNS basics. Two or more nameservers, a website that resolves with and without www, and whether CAA and DNSSEC are in use. The DNS lookup shows any record directly.
Fixes you can paste
Most checkers stop at "DMARC policy not enabled". That is true and not much help to someone who does not already know what to type. Where the correct record can be written from what the check found, it is shown in full, ready to paste at your DNS host. The SPF record includes your mail provider when it can be recognised from your MX records.
Some fixes cannot be written for you. A DKIM key comes from your mail provider, and an SPF record over the ten-lookup limit needs someone to decide which senders to keep. Those say what to do instead.
What happens to what you enter
The email and DNS checks run in your browser against Cloudflare's public resolver. The certificate check connects from our server, because a browser cannot open a raw TLS connection. We count that a check ran, not which domain it ran on.