DNS Health Checker
One of the free tools from KinetixSEO, an SEO and AI-citation (GEO) checker. Check any domain's email authentication (SPF, DKIM, DMARC), DNSSEC signing, and IPv4/IPv6 reachability — the DNS misconfigurations that quietly undermine domain trust and deliverability.
Frequently asked questions
What DNS records does this tool check?
SPF, DMARC (and whether it's actually enforced, not just present), MX mail-routing records, DNSSEC signing status, DKIM selector presence, and dual-stack IPv4/IPv6 reachability.
Why does SPF/DMARC matter for SEO?
It doesn't directly — but a domain with weak email authentication is far more likely to be spoofed for phishing, and search/AI crawlers increasingly weight overall domain trust and security posture as a soft ranking and citation signal.
What does "DMARC present but not enforced" mean?
A DMARC record with policy p=none only monitors — it doesn't actually block spoofed mail. p=quarantine or p=reject are the enforcing policies; p=none is a common (and often forgotten) first step that was never finished.
What is dual-stack and why would I want it?
Dual-stack means your domain resolves to both an IPv4 (A) and IPv6 (AAAA) address. IPv6-only or IPv4-only setups can be unreachable from networks or crawlers that prefer the other family — dual-stack is the safest default today.
Is DNSSEC required?
No, but it prevents DNS spoofing/cache-poisoning attacks by cryptographically signing your DNS records. It's increasingly considered a baseline security best practice, especially for domains handling sensitive traffic.
This is one check from KinetixSEO's full SEO/GEO audit. Want the complete picture — Core Web Vitals, AI-citation readiness, technical SEO health, and tailored fixes? Run the free full checker.