Free DNS Checker: See What Your Domain's DNS Reveals

What a DNS checker looks at, and why it matters

A DNS checker reads the address book for your domain. DNS tells the world which server answers for your website (A and AAAA records), which servers accept your mail (MX records), which certificate authorities are allowed to issue your TLS certificates (CAA records), and a pile of supporting details stored as TXT records, including your email-authentication policies.

Every one of these records is public. Anyone can query them in seconds, no permission required, which means an outsider sizing up your site already knows a lot before they ever load your home page. A DNS checker simply reads what is already out there and tells you, in plain English, what it says about you.

DNS misconfigurations are quietly expensive. A missing MX or a typo in a mail record can silently drop email. A missing CAA record means any certificate authority can issue a certificate for your domain. Stale records pointing at servers you no longer control can become a foothold for takeover. None of this is exotic; it is housekeeping that almost every small business gets a little bit wrong.

How BadgerScan checks your DNS

BadgerScan is not a separate stand-alone gadget. The DNS check is one part of a single free external scan that also covers your email security, TLS certificate, HTTP security headers, and exposed files, plus known CVEs for any publicly-detectable software versions. You enter your domain once and get one combined picture.

For DNS specifically, the scan performs a passive, read-only lookup. It resolves your core records, checks for the presence and basic sanity of MX and CAA, and reads the TXT records that carry your email-authentication policy so it can hand those off to the email-security part of the report. It is qualitative: the goal is to tell you what is missing or misconfigured in language you can act on, not to drown you in raw record dumps.

BadgerScan never probes, exploits, or actively tests anything. It only reads what public DNS already publishes. To see your own results, run the free scan on your domain. If you want the inside view too, exact plugin, theme and core versions and their CVEs, that comes from the read-only Pro plugin, and both halves fuse into one grade.

How to read your DNS result

Your DNS findings appear inside the combined report rather than as an isolated score. A clean result means your records resolve correctly, mail is pointed at the right place, and the supporting records that protect you (like CAA and your email-authentication TXT records) are present and sensible.

Flags fall into a few buckets. Missing protection means a record that should exist does not, for example no CAA record, which is a recommendation to add rather than an active break. Misconfiguration means a record exists but is wrong or contradictory, such as mail that cannot actually be delivered. Exposure means a record reveals more than it needs to, like internal hostnames in public TXT records.

Treat the DNS section as a checklist. Most items are low-effort, high-value fixes you make once at your domain registrar or DNS host, and then they protect you indefinitely. If an item references email authentication, follow it through to the SPF, DKIM and DMARC detail for the exact records to publish.

Common DNS fixes

Most DNS problems have a one-time fix you make in your registrar or DNS host's control panel. The usual suspects:

• Add a CAA record so only your chosen certificate authority (for example Let's Encrypt or your host's provider) can issue certificates for your domain.
• Confirm your MX records point at the mail provider you actually use, with the correct priority, so legitimate email is never silently dropped.
• Publish your email-authentication records (SPF, and a DMARC policy) as TXT records so your domain is harder to spoof. See the email-security check for the exact values.
• Remove stale or orphaned records pointing at servers, IPs, or services you no longer use, which can otherwise be abused for subdomain takeover.
• Trim public TXT records that leak internal hostnames, vendor names, or other detail an outsider does not need.
• Keep your nameservers consistent. If your registrar and your DNS host disagree about who is authoritative, records can resolve unpredictably.