DNS health grade: A/NS/MX, SPF, DMARC, DKIM, Spamhaus ZEN. Paste a URL.
DNS health checks
The grade comes from seven checks: A, NS, MX, SPF, DMARC, common DKIM selectors, and whether the first A record is on Spamhaus ZEN. MX/DKIM warnings are expected on a site that never receives mail.
Check
What is looked up
Note
A
IPv4 address
Without it the site does not resolve. Fail.
NS
Name servers
Without NS the zone is missing. Fail.
MX
Mail hosts
Warning if missing. Not required for a website-only name.
Tries google, selector1, k1 and similar. Use the DKIM tool for a custom selector.
ZEN
Spamhaus ZEN
Fail if the first A-record IPv4 is listed. Delist via that list.
What is the DNS health grade?
The tool looks up the name via Cloudflare ALL: A and NS are required, MX/SPF/DMARC/DKIM warn if missing, Spamhaus ZEN fails if listed. The score is passed / 7 × 100. The letter (A–F) follows the same percentage.
100 is not required. Missing MX or DKIM is expected on a site that never sends mail. A listed IP hurts both web and mail reputation.
Chips and URLs
Chips for .com, .net, .org, .com.tr and others switch the TLD. https://www.example.com/path or example.com:443 is accepted; www is dropped.
The query leaves from this Linux host. Resolver cache may show old SPF/DMARC briefly. The rate limit cuts off frequent clicks.
Web vs mail
A and NS are enough for the web. Missing MX is amber: the site still loads, mail cannot be received. SPF, DMARC and DKIM protect outbound mail against spoofing.
“No DKIM” only means common selectors such as google, selector1 and k1 were empty. Try your real selector on the DKIM tool.
Who publishes what?
SPF, DMARC and DKIM live in your domain DNS panel. PTR (reverse DNS) is set by the IP-block owner; this summary does not score PTR. Spamhaus ZEN is a separate lookup of the first A-record IPv4.
Delist via that list’s own process. This page is not a security audit or ISO evidence.
Frequently asked questions
Must the score be 100?
No. Missing MX/DKIM is expected on a site that never sends mail. AAAA is not one of the seven checks.
Why Spamhaus here?
If the A-record IP is listed, both web and mail reputation suffer. Delist via that list’s process.
What does DKIM not found mean?
Common selectors like google and selector1 were empty. Try your real selector on the DKIM tool.
Is the score live?
Each click re-queries. Resolver cache may show old SPF/DMARC for a short time.
Is this a security audit?
No. It is a quick health grade, not a pentest or ISO evidence.