# Health checks

On every sync, DNScheck runs a set of health checks against each monitored zone and shows the results in the zone's **Health** panel. The zones list shows a colored dot with each zone's worst status, and the **Checks** page lists every check across all your zones, with search and filters for status, check type, and zone.

Each check reports one of four statuses:

- **ok** — the check passed.
- **warn** — something worth fixing, but not broken (for example, a missing SPF record).
- **fail** — something is broken or about to be.
- **unknown** — DNScheck couldn't determine the answer this run (for example, a lookup timed out). Unknown never triggers an alert.

Alerts are only sent when a check **fails**, and again when it **recovers** — warnings stay in the panel so routine issues don't flood your inbox.

## The checks

### Delegation

Verifies that your domain's live NS records still point at the DNS provider hosting the zone. If the delegation breaks — say the domain is switched to different nameservers while your records still live at the old provider — the check fails and you're alerted.

### Target health

For CNAME and ALIAS records, DNScheck resolves the target and fails the check when it no longer exists (a *dangling* record). Dangling records pointed at claimable hosting services are a subdomain-takeover risk, so DNScheck also probes a curated list of provider fingerprints and flags targets that look unclaimed.

### Final-IP monitoring

Tracks the IP address a CNAME/ALIAS record ultimately resolves to and records an event when it changes. Useful for spotting a hosting provider silently moving your app. Records that resolve to a new IP constantly (geo-distributed CDNs) are detected as flapping and monitoring is automatically paused for them — the Health panel tells you when that happens. You can control final-IP monitoring per record, per zone, or per team.

### Email authentication: SPF, DMARC, and DKIM

Three checks watch the DNS records that protect your domain from email spoofing:

- **SPF** — warns when no SPF record exists, and fails on invalid setups: multiple SPF records, or a policy of `+all` (which lets anyone send as your domain).
- **DMARC** — warns when no DMARC record is published or the policy is `p=none` (present but not enforcing), and fails on a malformed record.
- **DKIM** — warns when no `_domainkey` records exist for the domain.

### Domain expiry

Looks up your domain's expiry date in the registry (via RDAP) and turns yellow inside 30 days, red inside 7 days or when the domain has expired.

### Transfer lock

Checks that your domain's registrar transfer lock is on, and warns when the domain could be transferred away.

Some registries (for example `.nl`) don't publish expiry dates or transfer-lock state. When the registry can't answer, DNScheck hides these checks for that domain rather than showing a permanent "unknown".