Zone health checks: catch broken DNS before your users do
DNScheck started out as change detection. It tells you when a record changes. But a lot of DNS problems involve no change to your records at all. The domain expires. A Heroku app gets deleted and the CNAME pointing at it is left dangling. Someone flips the registrar transfer lock off. Your zone looks exactly the same while it breaks.
So every monitored zone now runs a set of health checks on each sync.
The checks
Delegation. Your domain's live NS records should point at the provider that hosts the zone. If they don't, every record you edit in DNScheck or at the provider does nothing. This check fails when the two disagree.
Target health. For each CNAME and ALIAS record, DNScheck resolves the target. If it no longer exists, the record is dangling. Dangling records that point at hosting services where anyone can claim the name, such as cloud storage buckets or app platforms, are a subdomain-takeover risk. DNScheck fetches those targets and compares the response against known "this doesn't exist" pages from those services.
Final IP. Tracks the IP a CNAME or ALIAS finally resolves to and records an event when it changes. Useful when your host moves your app without telling you.
SPF, DMARC, and DKIM. Zones with MX records get their email authentication checked. A missing SPF record or a DMARC policy of p=none is a warning. Two SPF records, an SPF +all, or a malformed DMARC record is a failure. Zones that don't receive mail skip these checks.
Domain expiry. DNScheck looks up the expiry date in the registry over RDAP. It turns yellow 30 days out and red at 7.
Transfer lock. Warns when the registrar lock is off and the domain could be transferred away.
Only failures page you
Each check is ok, warn, fail, or unknown. Only fail sends an alert, and you get a second one when the check recovers. Warnings stay in the panel. A missing DKIM record is worth fixing, but it shouldn't wake anyone up.
unknown means DNScheck couldn't get an answer this time, for example because a resolver timed out or a registry was down. It never alerts. We'd rather miss one five-minute window than page you over our own network trouble.
Where to see them
Each zone has a Health panel showing anything that isn't ok, with a toggle to show everything. The zones list has a colored dot per zone. And the new Checks page lists every check across all your zones, with filters for status, check type, and zone. The health checks docs explain each verdict.