Full DNS report
The full report runs every check in this toolkit against one domain in a single pass: the records from A to CAA, DNSSEC status, whether the nameservers agree with the registry, the SPF, DKIM and DMARC records, and what several public resolvers answer. If you do not yet know which part of the domain is at fault, start here.
Need another tool?
Pick one of the 25 belowOutput
What the full report measures
The full report runs every check in this toolkit against one domain in one pass: the NS, A, AAAA, MX, SOA, CAA and TXT records, the _dmarc, _mta-sts and _smtp._tls names, seventeen common DKIM selectors, the CNAME chain, the DS and DNSKEY records, the parent zone's delegation and whether glue is required, each nameserver's SOA serial, six public resolvers, the TTLs of the A, AAAA, NS, MX, SOA and TXT records, and the reverse names of the web and mail addresses.
Most queries go to Cloudflare's 1.1.1.1 over the toolkit's own DNS engine; the parent's own servers, each authoritative nameserver and the Google, Quad9, OpenDNS, TCI and IPM resolvers are asked where their answer is the point. TTLs are graded from the zone's own nameservers (for a subdomain, the zone it sits in; for an alias, only the CNAME's own TTL), because a resolver reports only the time left on its cached copy. The report is a snapshot of that moment, and because one run fans out to dozens of queries it shares the six-a-minute budget of the Reachability, Ping, Traceroute, MTR and Port check tools.
How to read the result
The banner says everything looks healthy only when there is nothing to fix and nothing was left unknown, and otherwise how many recommendations were found; the list is the last section, and each item rests on a record shown above it. A section whose query never answered says Query went unanswered rather than none, and nothing is concluded from it: a timed-out MX query is not a domain without mail. For a name that does not exist the report says only that, rather than reading every section as empty, also when only the resolver said so and the zone's own servers could not be reached to confirm it, which it notes; for a subdomain, DMARC, DNSSEC and CAA are read from the domain and zone that cover it, the way mail receivers and certificate authorities apply them.
Under Email, SPF lookups counts the DNS lookups the record needs against the limit of ten, and SPF ends in shows the qualifier, through redirect= when the record ends in one; +all or ?all protects nothing. Under Delegation, Unverified means a nameserver could not be asked directly, which a firewall on the path can cause; Lame means the nameserver answered REFUSED or NXDOMAIN for the zone, answered without authority (a referral onwards or a cached answer), or has no address at all; the first six nameservers are asked. TTLs under 60 seconds are very short, under 300 short, up to a day normal; a type the zone does not publish reads not published, and one no nameserver answered for shows the cached number marked cache only, not graded, with the reason under the table. A web address behind a CDN with no PTR is not a fault; for a mail server the round trip matters when it also sends mail, because receivers check the sending address.
When it is useful
When a domain misbehaves and nobody knows which layer is at fault: mail bouncing, a subdomain failing now and then, a certificate authority refusing to issue. Run the report once, then narrow down with the tools it is built from: DNS records, Email security, Delegation check, DNSSEC check.
After a move to new nameservers, to confirm in one run that the parent agrees with the zone, the first six nameservers carry the same serial and every resolver already gives the new answer. The .txt download and the share link, kept for 30 days, make it something to hand to a hosting provider.
Common questions
What does a full DNS report check?
The NS, A, AAAA, MX, SOA, CAA and TXT records, SPF, DKIM, DMARC, MTA-STS and TLS-RPT, DNSSEC, the delegation against the parent, SOA serials across nameservers, propagation across six resolvers, TTL grades, and the reverse names of the web and mail addresses.
Why does the report say a query went unanswered?
One query timed out, was refused or returned SERVFAIL. The report says so instead of showing an empty record, concludes nothing from it, and names it in a recommendation to check again. Run it again; if it repeats, Delegation check will say which nameserver is at fault.
Does the full report work on an IP address?
No, it answers questions about a domain name. For an address, WHOIS shows who holds the block and Reverse DNS shows the PTR name.
Limits. The DNS, WHOIS and SSL tools allow up to 20 requests a minute per IP address. Ping, traceroute and MTR send real packets to their target, so they allow 6 a minute.
The port check runs only against your own IP address. That is deliberate: the question people actually have, "is this port reachable from outside?", is answered by it, while this server cannot be used to scan anyone else's network.
Private and reserved addresses. These are refused by the tools that really connect to their target: the SSL check, ping, traceroute, MTR and the port check. The DNS tools have no such limit, because they only ask a nameserver a question and never connect to the address itself.