LeaderboardEvery site, rankedFree toolsChecks, no sign-upAgentsYour agent fixes itDocsThe API and MCP

DNS health checker

Read a domain’s DNS from public resolvers: its name servers and SOA, its addresses, CAA, and every record its mail depends on, with what is wrong with each in words.

More checksPagesUtilities

The answer for allbirds.com

allbirds.comNo problems, 2 warnings

2warnings7good3notes

Name servers

  • Good5 name servers
  • GoodSpread over 4 networksAn outage at one network leaves the others answering.
  • WarningThe SOA timers look offThe negative cache time is over a day (172800 s), so a record just added can stay unseen that long.
  • Not checkedDNSSECclickd asks public resolvers through a lookup that does not return DNSSEC signatures, so whether this domain is signed is not checked here.
  • NSallbirds.comns1.markmonitor.com 149.112.160.1
  • NSallbirds.comns2.markmonitor.com 176.97.158.1
  • NSallbirds.comns3.markmonitor.com 149.112.161.1
  • NSallbirds.comns4.markmonitor.com 192.174.68.1
  • NSallbirds.comns5.markmonitor.com 149.112.160.2
  • SOAallbirds.comns1.markmonitor.com hostmaster.markmonitor.com serial 2026102801 refresh 86400 retry 3600 expire 2592000 minimum 172800

The site’s addresses

  • Goodallbirds.com resolves1 IPv4 address.
  • NoteNo IPv6 address (AAAA)Not required: every visitor and crawler that has IPv6 has IPv4 too, today.
  • Goodwww.allbirds.com is an alias for shops.myshopify.com
  • Aallbirds.com23.227.38.32
  • CNAMEwww.allbirds.comshops.myshopify.com

Certificate authorities

  • NoteNo CAA recordsAny certificate authority may issue a certificate for this domain. Optional: a CAA record names the ones you use, so no other will.

Mail

MXSPFDMARCDKIM
  • GoodMail goes to 1 serverallbirds-com.mail.protection.outlook.com, priority 0
  • GoodSPF is sound: 5 of 10 lookups5 of 10 DNS lookups.
  • GoodDMARC is enforced: p=quarantineMail that fails SPF and DKIM is held to the policy, and reports go to an address.
  • Warning7 DKIM keys found, 2 need a lookAt google, selector1, selector2, k1, s1, s2, mandrill. Only the common selectors were tried.
  • MXallbirds.com0 allbirds-com.mail.protection.outlook.com
  • TXTallbirds.comv=spf1 include:allbirds_com._es.easydmarc.com include:spf.protection.outlook.com ~all
  • TXT_dmarc.allbirds.comv=DMARC1;p=quarantine;pct=100;rua=mailto:[email protected];ruf=mailto:[email protected];fo=1
  • TXTgoogle._domainkey.allbirds.comv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0KZQDhKamuRPsAWE44JoN32kfP9t…
  • TXTselector1._domainkey.allbirds.comv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuQykGz2tFvDCnUF/KSyUH10yPpXC…
  • TXTselector2._domainkey.allbirds.comv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqLLaL9M8ukYctNYL3bxPLsxN2Fg8…
  • TXTk1._domainkey.allbirds.comk=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8…
  • TXTs1._domainkey.allbirds.comk=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4w6eQpkTmhsfp38/LSv37t/lCm7DK+x1…
  • TXTs2._domainkey.allbirds.comk=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2AVEC4/+vILMoJ54zYflkyJa9RtDOOyX…
  • TXTmandrill._domainkey.allbirds.comv=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3…

Asked of public resolvers (1.1.1.1 and 8.8.8.8) as anyone on the internet sees it, at the moment of the check. A record changed in the last few hours may not show everywhere yet.

That was allbirds.com’s DNS.clickd reads the site’s first 100 pages against one rulebook and ranks every fix by what it is worth. Free, about a minute.
Read the whole site

What does it check?

No rule in the rulebook covers this, so here is what it reads.

  1. The name servers, and whether each answers
  2. The SOA record and its timings
  3. The addresses the name points to, IPv4 and IPv6
  4. CAA, which says who may issue its certificates
  5. Every record its mail depends on

Questions

How long do DNS changes take?

As long as each record’s TTL. Resolvers keep an answer that long before asking again.

How many name servers should a domain have?

At least two, on separate networks, so the domain still answers when one is down.

What is a CAA record?

A record that names the certificate authorities allowed to issue certificates for the domain.

A zone with nothing missingExample
NameTypeValue
@NSns1.dns-one.example.
@NSns2.dns-two.example.
@SOAns1.dns-one.example. hostmaster.example.com. 2026102301 7200 3600 1209600 3600
@A203.0.113.10
@AAAA2001:db8::10
@CAA0 issue "letsencrypt.org"
@MX10 mail.example.com.
@TXT"v=spf1 mx -all"
_dmarcTXT"v=DMARC1; p=reject; rua=mailto:[email protected]"

Two name servers on separate networks, an address for IPv4 and IPv6, CAA naming the one authority that may issue, and every record its mail needs.

The whole site

One page is one part. A read checks every page against the whole rulebook and says what to fix first.

See allbirds.com’s report