Health checks
On every sync, DNScheck runs a set of health checks against each monitored zone and shows the results in the zone's Health panel. The zones list shows a colored dot with each zone's worst status, and the Checks page lists every check across all your zones, with search and filters for status, check type, and zone.
Each check reports one of four statuses:
- ok — the check passed.
- warn — something worth fixing, but not broken (for example, a missing SPF record).
- fail — something is broken or about to be.
- unknown — DNScheck couldn't determine the answer this run (for example, a lookup timed out). Unknown never triggers an alert.
Alerts are only sent when a check fails, and again when it recovers — warnings stay in the panel so routine issues don't flood your inbox.
The checks
Delegation
Verifies that your domain's live NS records still point at the DNS provider hosting the zone. If the delegation breaks — say the domain is switched to different nameservers while your records still live at the old provider — the check fails and you're alerted.
Target health
For CNAME and ALIAS records, DNScheck resolves the target and fails the check when it no longer exists (a dangling record). Dangling records pointed at claimable hosting services are a subdomain-takeover risk, so DNScheck also probes a curated list of provider fingerprints and flags targets that look unclaimed.
Final-IP monitoring
Tracks the IP address a CNAME/ALIAS record ultimately resolves to and records an event when it changes. Useful for spotting a hosting provider silently moving your app. Records that resolve to a new IP constantly (geo-distributed CDNs) are detected as flapping and monitoring is automatically paused for them — the Health panel tells you when that happens. You can control final-IP monitoring per record, per zone, or per team.
Email authentication: SPF, DMARC, and DKIM
Three checks watch the DNS records that protect your domain from email spoofing:
- SPF — warns when no SPF record exists, and fails on invalid setups: multiple SPF records, or a policy of
+all(which lets anyone send as your domain). - DMARC — warns when no DMARC record is published or the policy is
p=none(present but not enforcing), and fails on a malformed record. - DKIM — warns when no
_domainkeyrecords exist for the domain.
Domain expiry
Looks up your domain's expiry date in the registry (via RDAP) and turns yellow inside 30 days, red inside 7 days or when the domain has expired.
Transfer lock
Checks that your domain's registrar transfer lock is on, and warns when the domain could be transferred away.
Some registries (for example .nl) don't publish expiry dates or transfer-lock state. When the registry can't answer, DNScheck hides these checks for that domain rather than showing a permanent "unknown".