Free Domain Health Checker
Twenty checks across your website, DNS, email authentication, registration and certificate, with a score and a plain-English fix for each problem. It runs in your browser, so nothing is logged here.
What it checks
- Website
- Whether your browser can open the site over HTTPS with a valid certificate, how fast it answers (cold and warm), whether the www version works, and whether a favicon is served.
- DNS
- IPv4 and IPv6 records, nameserver count and redundancy, the SOA record, DNSSEC signing and validation, and CAA records that limit who can issue certificates.
- Email authentication
- MX records that resolve, SPF syntax and its 10-lookup limit (counted recursively), DMARC policy strength, DKIM keys at common selectors, and MTA-STS / TLS-RPT.
- Registration & TLS
- Domain expiry and registrar transfer lock from the registry’s RDAP service, and the current certificate’s issuer and remaining validity from public Certificate Transparency logs.
Questions
Is the domain health checker really free?
Yes. There is no account, no limit set by this site and nothing to install. All checks run in your own browser.
How does it work without a server?
Your browser does the work. It loads the target site directly to test HTTPS and speed, and it reads DNS through the free public DNS-over-HTTPS resolvers from Cloudflare and Google. Registration data comes from the registries’ own RDAP servers and certificates from public Certificate Transparency logs. This site never sees the domain you check.
Why can it not read HTTP headers or status codes?
Browsers block a page from reading another site’s responses unless that site allows it (CORS). The checker sees only whether a secure connection succeeded and how long it took. That is enough to catch a broken certificate or a dead server, but not a missing security header.
Why is the response time different from other tools?
It is measured from your device and network, not from a data centre. That makes it closer to what your visitors in the same region experience, and it includes your own connection latency.
DKIM shows "info" — is it broken?
Not necessarily. DNS gives no way to list DKIM selectors, so the checker tries the defaults used by major providers. If you use a custom selector, look up s= in the DKIM-Signature header of an email you sent.