IPTOOL TR My IP

DNS

DNS Health Check: score, SPF, DMARC, ZEN

DNS health grade: A/NS/MX, SPF, DMARC, DKIM, Spamhaus ZEN. Paste a URL.

Daily queries 0 / 40

40 queries left

Sign up → 200/day · Pro → 5000/day Sign up / see Pro

Domain
TLD

https://example.com or www.example.com is accepted; www is dropped. Cloudflare ALL lookup. The score is a grade, not a pentest.

Queries leave from this Linux server, not your ISP DNS. Free. Cached answers can differ for a short time.

DNS health checks

The grade comes from seven checks: A, NS, MX, SPF, DMARC, common DKIM selectors, and whether the first A record is on Spamhaus ZEN. MX/DKIM warnings are expected on a site that never receives mail.

Check What is looked up Note
A IPv4 address Without it the site does not resolve. Fail.
NS Name servers Without NS the zone is missing. Fail.
MX Mail hosts Warning if missing. Not required for a website-only name.
SPF TXT v=spf1 Lists hosts allowed to send mail for the name.
DMARC _dmarc TXT p=none / quarantine / reject. Reports SPF/DKIM alignment.
DKIM selector._domainkey Tries google, selector1, k1 and similar. Use the DKIM tool for a custom selector.
ZEN Spamhaus ZEN Fail if the first A-record IPv4 is listed. Delist via that list.

What is the DNS health grade?

The tool looks up the name via Cloudflare ALL: A and NS are required, MX/SPF/DMARC/DKIM warn if missing, Spamhaus ZEN fails if listed. The score is passed / 7 × 100. The letter (A–F) follows the same percentage.

100 is not required. Missing MX or DKIM is expected on a site that never sends mail. A listed IP hurts both web and mail reputation.

Examples

Score
passed / 7 × 100Missing A/NS fails; missing MX/DKIM may only warn.
Example
blog.com · no MXExpected when the site never receives mail.

Chips and URLs

Chips for .com, .net, .org, .com.tr and others switch the TLD. https://www.example.com/path or example.com:443 is accepted; www is dropped.

The query leaves from this Linux host. Resolver cache may show old SPF/DMARC briefly. The rate limit cuts off frequent clicks.

Web vs mail

A and NS are enough for the web. Missing MX is amber: the site still loads, mail cannot be received. SPF, DMARC and DKIM protect outbound mail against spoofing.

“No DKIM” only means common selectors such as google, selector1 and k1 were empty. Try your real selector on the DKIM tool.

Who publishes what?

SPF, DMARC and DKIM live in your domain DNS panel. PTR (reverse DNS) is set by the IP-block owner; this summary does not score PTR. Spamhaus ZEN is a separate lookup of the first A-record IPv4.

Delist via that list’s own process. This page is not a security audit or ISO evidence.

Frequently asked questions

Must the score be 100?

No. Missing MX/DKIM is expected on a site that never sends mail. AAAA is not one of the seven checks.

Why Spamhaus here?

If the A-record IP is listed, both web and mail reputation suffer. Delist via that list’s process.

What does DKIM not found mean?

Common selectors like google and selector1 were empty. Try your real selector on the DKIM tool.

Is the score live?

Each click re-queries. Resolver cache may show old SPF/DMARC for a short time.

Is this a security audit?

No. It is a quick health grade, not a pentest or ISO evidence.