What the domain check tests
Twenty checks that usually run separately, in one pass, grouped into four areas. Each queries the authoritative name server or the server itself and rates the result the way browsers, mail receivers and certificate authorities do.
- Website (30% of the score): certificate valid, matching the hostname, not expiring soon, modern protocol; http and https, with and without www all end at the same address (for a subdomain such as shop.example.com http and https of that host, and the target may be elsewhere); security headers such as HSTS and Content-Security-Policy set; reachability over IPv6 if the domain has AAAA records; a valid security.txt if there is one; no Google Fonts from Google servers and no tracking scripts before consent.
- Email (35%): MX records present and resolvable, SPF, DKIM and DMARC present and plausible, MTA-STS and TLS-RPT in place, an existing BIMI record with a reachable logo and enforced DMARC (whether the mail server accepts connections is checked by monitoring, not by this tool).
- DNS (20%): records resolvable, DNSSEC signature chain intact, every name server reachable and authoritative with the same state of the zone, an existing CAA record matching the certificate authority of the current certificate.
- Domain (15%): expiry date, hold status, registrar; website and mail IPs and the domain itself on no blacklist.
IPv6 and further checks
For the IPv6 check the checking location itself needs an IPv6 route. Without one, the check only lists the AAAA records (of the domain and www, for a subdomain only of that host) and notes that reachability over IPv6 could not be verified. That is not a finding and costs no points. With IPv6 it fetches the website over every IPv6 address: an address that does not answer or returns 5xx is a warning, a redirect to a target without an AAAA record a hint.
DNS propagation and "Website down?" are not part of the check. Both answer a question about this very moment, for example after a DNS change or during an outage, and say little about how the domain is set up. They are therefore linked as "More checks" below the result.
The score
Every area starts with 100 points. Every check with a critical finding costs 20, every warning 7 (at most 20 per check), every note 1 (at most 3). The overall score is the weighted mean of the areas: website 30%, email 35%, DNS 20%, domain 15%. That way a domain with many email issues does not automatically drop to zero, and you see at a glance where it hurts. From 90 the domain is in great shape, from 70 good, from 50 fair, below that action is urgent. "Biggest wins" lists the findings whose fix gains the most points. The score is an overview, not a verdict: an expired certificate weighs more than missing DNSSEC even though both cost points.
The seven additional checks IPv6, HTTP/3, security.txt, privacy, name servers, CAA and BIMI are an exception: notes cost nothing there, only real problems count as a warning (7 points, at most 20 per check) or as critical (20). A domain without BIMI, security.txt, a CAA record, IPv6 or HTTP/3 therefore loses no points, nor does it for a single name server. Points are deducted for an expired or invalid security.txt, a BIMI logo that is unreachable or invalid, BIMI without enforced DMARC, a CAA record that locks out the certificate authority of the current certificate, an unknown critical CAA tag, unreachable or lame name servers, diverging SOA serials, AAAA records behind which the website does not answer, and Google Fonts from Google servers or tracking scripts loaded before consent. If no name server answers, it is critical. If none of the additional checks finds a real problem, only the thirteen core checks count.
Share the result
The address of the result page can be copied and passed on, for example to the customer or the host. Whoever opens it gets a fresh check (results are cached for five minutes). The page is not indexed by search engines.
Keep every customer domain in view
The domain check is a snapshot. DomainWarn runs the same checks for all customer domains of an agency on a schedule and reports changes, expiring certificates and domains, vanished mail records and outages before the customer notices.
Frequently asked questions
- What does "not checked (time budget)" mean?
- The checks run side by side (at most six at a time, each with its own timeout) within a time budget of 45 seconds. If servers or blacklists answer so slowly that the budget is used up before a check can start, it is skipped. It then counts neither as passed nor as a deduction: the area score is computed from the remaining checks, and an area without any completed check gets no score and drops out of the overall result. A second run a few seconds later uses the cached parts and usually checks everything. The check only stays without a score when a part ends with a real error, for example because the name server does not answer.
- Does the domain check count as one lookup?
- Yes. The twenty partial results are cached for five minutes and are then instantly available in the individual tools as well.
- Why is there no deduction for missing BIMI, security.txt or IPv6?
- These features are optional. A domain without them is not set up worse, just less extended. That is why notes cost no points in the six additional checks; points are only deducted when something exists but is broken, such as an expired security.txt or an AAAA record with nothing answering behind it.
- Why are DNS propagation and "Website down?" missing from the domain check?
- Both are snapshots without a target state: propagation shows what public resolvers currently have in their cache, "Website down?" whether the site answers at this instant. That helps with a specific change or an outage but says nothing about how well the domain is set up. Both are linked as "More checks" right below the result.
- The domain has no mail, yet points are deducted for SPF and DMARC?
- Even domains without mailboxes should carry SPF with -all and DMARC with p=reject, otherwise anyone can send in their name. The deduction is intentional.