What the domain check tests
Thirteen checks that usually run separately, in one pass, grouped into four areas. Each queries the authoritative name server or the server itself and rates the result the way browsers, mail receivers and certificate authorities do.
- Website (30% of the score): certificate valid, matching the hostname, not expiring soon, modern protocol; http and https, with and without www all end at the same address; security headers such as HSTS and Content-Security-Policy set.
- Email (35%): MX records present and resolvable, SPF, DKIM and DMARC present and plausible, MTA-STS and TLS-RPT in place (whether the mail server accepts connections is checked by monitoring, not by this tool).
- DNS (20%): records resolvable, DNSSEC signature chain intact.
- Domain (15%): expiry date, hold status, registrar; website and mail IPs and the domain itself on no blacklist.
The score
Every area starts with 100 points. Every check with a critical finding costs 20, every warning 7 (at most 20 per check), every note 1 (at most 3). The overall score is the weighted mean of the areas: website 30%, email 35%, DNS 20%, domain 15%. That way a domain with many email issues does not automatically drop to zero, and you see at a glance where it hurts. From 90 the domain is in great shape, from 70 good, from 50 fair, below that action is urgent. "Biggest wins" lists the findings whose fix gains the most points. The score is an overview, not a verdict: an expired certificate weighs more than missing DNSSEC even though both cost points.
Share the result
The address of the result page can be copied and passed on, for example to the customer or the host. Whoever opens it gets a fresh check (results are cached for five minutes). The page is not indexed by search engines.
Keep every customer domain in view
The domain check is a snapshot. DomainWarn runs the same checks for all customer domains of an agency on a schedule and reports changes, expiring certificates and domains, vanished mail records and outages before the customer notices.
Frequently asked questions
- What does "not checked (time budget)" mean?
- The checks run one after another within a time budget. If a server or a blacklist answers very slowly, the last checks are skipped. They then count neither as passed nor as a deduction: the area score is computed from the remaining checks, and an area without any completed check gets no score and drops out of the overall result. A second run a few seconds later uses the cached parts and usually checks everything. The check only stays without a score when a part ends with a real error, for example because the name server does not answer.
- Does the domain check count as one lookup?
- Yes. The thirteen partial results are cached for five minutes and are then instantly available in the individual tools as well.
- The domain has no mail, yet points are deducted for SPF and DMARC?
- Even domains without mailboxes should carry SPF with -all and DMARC with p=reject, otherwise anyone can send in their name. The deduction is intentional.