What is a domain health check?
A domain health check is a single report on everything that has to stay correct for a domain to work and be trusted: a valid TLS certificate, sound DNS, email authentication that stops spoofing, browser security headers, and a registration that is not about to lapse. Each is easy to check alone and easy to forget.
What the check covers
| Area | What is tested |
|---|---|
| SSL certificate | Validity, days remaining, chain completeness, hostname match, revocation, key strength |
| DNS | Address records, nameservers, CAA policy |
| MX records, SPF record and lookup count, DMARC policy, DKIM keys at common selectors | |
| Security headers | HSTS, CSP, framing, content-type, referrer and permissions policies, HTTP to HTTPS redirect |
| Registration | Expiry date of the domain itself, read over RDAP |
All of it runs in parallel and normally finishes in a few seconds. Every check is read-only: the tool resolves DNS, completes one TLS handshake, makes one HTTP request and asks the registry for the domain's public record. Nothing is changed and nothing is probed beyond that.
How the score is calculated
Every domain starts at 100. Points are subtracted for each problem found, weighted by how much damage it does. The grade follows the score: A from 90, B from 80, C from 70, D from 60, F below.
| Problem | Points |
|---|---|
| Certificate expired, invalid, revoked or unreachable | −40 |
| Certificate does not match the hostname | −30 |
| Certificate expires within 7 days, or registration within 30 | −25 |
| No DMARC record | −12 |
| No SPF record; certificate renewal overdue; incomplete chain | −10 |
| SPF over the 10-lookup limit; HTTP does not redirect to HTTPS | −8 |
DMARC policy is none; HSTS missing; single nameserver | −5 |
| Other missing headers, no CAA record, no DKIM key found | −2 to −3 |
Advice that is a matter of preference — no IPv6 address, a softfail SPF policy — is listed but costs nothing. A check that could not complete, such as a registry that does not answer, is reported as incomplete and never counted against the domain.
How to read the results
- Critical items are breaking something now or will within days: an expired certificate, a domain about to lapse, mail servers that do not resolve.
- Warnings leave a real gap — spoofable email, a renewal that should already have happened — but nothing is down.
- Info items are improvements worth making when convenient.
- Passed checks are listed too, so you can see what was actually tested.
Each finding names the problem in plain language and, where there is one, gives the exact record or setting to add. The section cards link to the dedicated tool for a deeper look — the full SPF include tree, the certificate chain, per-platform header configuration.
Domains that do not send email
If a domain has no MX records, the email checks are not scored. A domain that never sends mail does not need a mailbox provider's SPF include or a DKIM key. It should still be locked down, because attackers favor unused domains for spoofing — nobody is watching them. The report suggests the two records that do it:
| Name | Type | Value |
|---|---|---|
example.com | TXT | v=spf1 -all |
_dmarc.example.com | TXT | v=DMARC1; p=reject |
From a one-off check to monitoring
A health check is a snapshot. The things it tests fail on their own schedule: certificates expire, renewals silently stop working, a provider changes its SPF record, a registration lapses on a card that expired. With certificate lifetimes dropping to 47 days by 2029, the renewal process runs many times a year and each run is a chance to fail.
NetworkAI's certificate and domain monitor runs the certificate and registration checks every day and alerts when a renewal has not happened by the point it should have — rather than a fixed number of days before expiry.