The DNS records receivers check before they take your mail
MX and its delivery path, DNSSEC validated and not merely present, CAA, reverse DNS with forward confirmation, and whether a stranger can download your whole zone. Checked every ten minutes on the same domain
DNSSEC that is actually valid
A DS record left behind from an old key makes your domain unresolvable for every validating resolver, and it looks like nothing from the inside
- DS and DNSKEY matched
- Orphan DS records found
- Deprecated algorithms per RFC 9904
- Signature validity window checked
Reverse DNS, confirmed both ways
Receivers weigh a PTR record heavily, and a one-way PTR costs you delivery without producing an error anyone would notice
- PTR present on every sending address
- Forward-confirmed back to the same IP
- Coverage shown as a fraction
- Checked for each MX host
DANE, the TLSA records in your zone
A TLSA record pins your certificate in DNS, and renewing the certificate without updating the record turns your own zone into the thing refusing your mail
- TLSA records read and matched
- Checked against the live certificate
- Domain and every MX host
- Failure named, not just flagged
What the DNS checks look at
Six things that decide whether mail for your domain is accepted, and that almost nobody checks by hand twice
MX and the path behind it
Not just that records exist
Each host in your MX is connected to on ports 25 and 587, STARTTLS is negotiated and the certificate is read. An MX pointing at a CNAME or at a bare IP address breaks RFC 5321 and is reported as such
An open zone transfer
The whole map, handed to anyone
AXFR is attempted against each of your authoritative servers. A server that agrees hands over every internal host, staging name and subdomain you have, which is a ready-made target list. This surfaces on its own, usually after a migration to a new DNS provider
DNSSEC that has quietly broken
The failure you cannot see locally
A DS record at the registrar that no longer matches your DNSKEY makes the domain fail validation everywhere, so mail and web stop working for some people and not others. Orphan DS records, SHA-1 digests, deprecated algorithms and expired signatures are each reported separately
Reverse DNS, both directions
FCrDNS, not just a PTR
A PTR record is checked and then confirmed forward, so the hostname it gives resolves back to the same address. Receivers weigh this heavily, and a missing or one-way PTR costs you delivery without ever producing an error you would notice
Certificate authority permissions
CAA, and the reports it produces
Which authorities may issue for your name, including issuewild and issuemail, with values inherited from the parent domain the way RFC 8659 requires. When an authority refuses a request because of your CAA, its report is accepted and stored against the domain
The registration itself
Because losing the domain is worse
Registrar, expiry date and lock status are read over RDAP with a WHOIS fallback, and you get a reminder 7, 3 and 1 days before the registration lapses. It is the cheapest check here and the most expensive thing to get wrong
What is looked up, and what a bad answer costs you
Six lookups, and only two of them are about mail arriving. The others decide whether someone else can read your zone, issue your certificates or take your name
| Lookup | Job | What a bad answer means |
|---|---|---|
| MX and the hosts behind it | dns:mx | Mail has nowhere to go, or goes somewhere you no longer control |
| Reverse DNS on each of those hosts | dns:rptr | Receivers score you lower, and some refuse outright. Forward-confirmed means the PTR resolves back to the same host |
| DNSSEC, validated and not merely present | dns:dnssec | A broken chain is invisible from a resolver that does not validate, and a hard failure from every one that does |
| Zone transfer, offered to anyone | dns:axfr | Your whole zone handed over on request, including the names you never published anywhere |
| CAA and its iodef address | dns:caa | Any certificate authority may issue for your domain, and nobody tells you when one does |
| The registration itself | domain:whois | An expiry nobody watched, which costs more than every other row combined |
Each of these is a separate check with its own history, so a change shows up as a change rather than as a different overall score
Three steps, about ten minutes
Nothing to install. Everything here is read from public DNS and from a connection to your own mail hosts
Enter the domain
MX, DNSSEC, CAA and reverse DNS are read and shown together, each with the record it found and what is wrong with it
Look at the zone transfer result first
It is the one finding here that is a live exposure rather than a configuration opinion, and it is the one people are most often surprised by
Leave it watching
On an account the same checks repeat every ten minutes, and you get an email when a record changes or a check starts failing
Questions about the DNS checks
What each record does, how often it is checked, and which failures are visible only from outside
They can if any of your authoritative name servers allows a zone transfer, and a surprising number do after a migration. We ask each of your name servers for one and tell you which agreed. An open transfer hands over every internal host, staging name and subdomain you have, which is a ready-made target list for someone writing a phishing campaign.
Yes. CAA (Certificate Authority Authorization) records are critical for SSL/TLS security. We audit them to ensure only authorized CAs can issue certificates for your domain.
DNSSEC adds a layer of security to the DNS protocol by adding digital signatures. It protects users from being redirected to malicious sites by cache poisoning attacks.
DNS latency is the time it takes for a DNS server to respond to a query. High latency can delay website loading and email delivery processes.
With RUA•Watcher, you don't need to manually check. Our automation monitors your critical records 24/7 and alerts you only when something changes or breaks.
Find out whether your zone can be downloaded
The zone transfer probe alone is worth the ten minutes it takes. One domain is free, and there is no card to enter