DNS Check

Checks your domain's DNS configuration — from the completeness of records to security mechanisms like DNSSEC and zone transfer protection.

Check	What is checked
Snapshot	All standard record types (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA) are queried and displayed.
Nameservers	At least two NS records for redundancy? Including the IPs of each nameserver and the TLD nameservers.
SOA	Does the SOA record exist (serial, refresh, retry, expire)?
CAA	Does a CAA record restrict which CAs may issue certificates? Without CAA, any CA may issue (warn).
DNSSEC	DNSKEY + DS present = complete chain of trust (ok); additionally a validating resolver checks whether the signatures actually verify. A broken chain (doesn't validate, "bogus") = fail, because validating resolvers then can no longer resolve the domain. Only DNSKEY without DS at the registrar = incomplete (warn).
Zone transfer (AXFR)	Vernax attempts a zone transfer at each nameserver. If it succeeds, all DNS records are publicly readable (fail).
Extended records	NAPTR, SSHFP, HTTPS, SRV, LOC, URI, CERT — display only (info).

Explain mode: the journey of a DNS query

The explain mode shows the complete resolution path from the root zone via the TLD to your nameserver — and for DNSSEC the full chain of trust with the real key tags and digests of your zone.