How it works
What a check does, how results are decided, and what the badge and the list of reports are.
A check, step by step
- We start at the DNS root and follow the delegations down (for example
.→com.→example.com.) to find the domain's zone and its nameservers. A name such aswww.example.combelongs to the zoneexample.com. - We ask those nameservers directly. No public resolver sits in between, so the answers are the domain's own.
- Four sets of rules judge the answers. The rules are fixed and versioned; the same answers always give the same result. No AI and no manual grading are involved.
A check is small on purpose: at most 100 DNS questions in 20 seconds, spread over the servers involved. We never transfer zones, guess subdomains, scan ports or connect to the website.
Results
| Status | Meaning |
|---|---|
| Healthy | Every check passed. Information notes may still be shown. |
| Needs attention | At least one warning: things work, but something should be fixed. |
| Problems found | At least one check failed: something is broken for some or all visitors. |
| Unable to check | We could not get conclusive answers. This is never counted as a failure. |
Optional features are information, never failures: a domain without DNSSEC or without CAA records can be healthy. A result describes the DNS configuration at the time of the check. It is not a statement that a website is safe, trustworthy or always available.
The four checks
Resolution. The name you entered and the domain itself should lead to an address (A for IPv4, AAAA for IPv6). We follow aliases (CNAME) up to eight steps, and report names that do not exist, dead-end or looping aliases, aliases at the domain itself, and private addresses that cannot be reached from the internet.
Nameservers. Every nameserver should answer for the zone, over UDP and TCP, with the same data. We compare the parent zone's list with the zone's own, compare serial numbers, check glue records for nameservers inside the domain, and note when all nameservers sit in one network.
DNSSEC. When the parent zone has a DS record for the domain, the chain of signatures must validate from the DNS root down. We report broken chains, expired or expiring signatures, keys that do not match, signed zones whose DS record is missing at the registrar, and deprecated algorithms.
CAA. We look for CAA records from the name up to the domain, list the certificate authorities they allow, and report records that would stop authorities from issuing certificates.
Daily re-checks
Each domain is re-checked once a day, at a time spread over the day. When something changes, the report shows the change in its history. When a re-check cannot complete, the report keeps the last complete result, says so, and we retry later. After 7 days without a complete result, the status becomes "Unable to check".
Daily re-checks continue while a verified badge is on the domain's site. Without one, they stop 30 days after the first check; the report stays available and anyone can run a new check.
The badge
The badge shows the domain's latest stored result and links to its report. It comes in three styles (minimal, standard and detailed), each in a light and a dark version. Viewing a badge never starts a new check; it is updated when the stored result changes.
To verify a badge, enter the page where you placed it. That page must be on the domain itself or its www version. Our verification crawler loads that page and looks for the badge inside its link to the report. It checks again every 3 days. Short outages of your site do not count as removal; the badge counts as removed after two checks in a row that find the page but not the badge.
The list of reports
The list of reports shows domains with a verified badge, with their status and a link to their report and their site. A domain is listed while its badge is verified and leaves the list when the badge is removed or its page can no longer be loaded for 14 days. To leave the list, remove the badge.
Questions
- Do I need to own the domain to check it?
- No. Anyone can check any domain; the results only use public DNS answers. Only the badge needs access to the site.
- Does a check affect my site?
- No. A check sends a few dozen small DNS questions to the domain's nameservers and never contacts the website.
- Why does my result differ from another tool's?
- We ask the domain's own nameservers directly and apply the rules described here. Tools that ask a public resolver may see cached or filtered answers.
- What does it cost?
- Checks, reports, daily re-checks and the badge are free. More features may follow later.