How it works
Once a day, we review your DNS setup for weak spots:
- Dangling CNAME: your host is a CNAME to a target that no longer resolves, such as a deleted cloud app or bucket. Anyone who claims that target can serve content on your domain. This is a subdomain takeover.
- CAA: a CAA record limits which certificate authorities may issue certificates for your domain. We also warn when your CAA record does not allow the authority that issued your current certificate, because the next renewal would fail.
- DNSSEC: signs your DNS answers so they cannot be forged.
- Nameservers: every nameserver should answer and serve the same SOA serial. A nameserver that is down or out of date gives some visitors stale or missing answers. Some networks block DNS queries on UDP port 53, in which case this part is skipped.
Statuses
| Status | Meaning |
|---|---|
| OK | No weak spots found. |
| Warning | No CAA record, no DNSSEC, a nameserver does not answer, nameservers disagree, CAA excludes your current authority, or a lookup failed. |
| Failed | Your host points to a CNAME target that does not resolve. |
By default you are notified of failures only.
Fixing common problems
- Dangling CNAME: remove the record, or recreate the service it points to.
- No CAA: add one for each authority you use, e.g.
example.com. CAA 0 issue "letsencrypt.org". - No DNSSEC: enable it at your DNS provider, then add the DS record at your registrar. Many providers do both in one click.
- Nameservers disagree: a secondary nameserver is not receiving zone transfers. Check its configuration, or remove it from your NS records.