Is my DNS set up properly?

Short answer: DNS problems rarely show until something breaks. A healthy setup has at least two nameservers, DNSSEC either fully on or cleanly off, no records pointing at services that no longer exist, mail servers that resolve, and a domain that isn't about to expire.

How to check it yourself

Look up your nameservers: dig NS yourdomain.com. There should be at least two.
Check DNSSEC: dig DS yourdomain.com against your DNS provider's DNSSEC setting.
Check your CNAMEs point at things that still exist, and your MX records resolve.
Look up your domain in WHOIS or RDAP for the expiry date and transfer lock.

Why it matters

DNS is what connects your domain to your website and email. A small mistake there can take both down at once, and because DNS changes take time to spread, problems can appear hours after the change that caused them. DNS is also rarely looked at until something breaks.

Common causes

Records left over from old hosting or email providers.
Nameservers at the registrar that don't match where the records are actually managed.
DNSSEC turned on at one end but not the other.
A record changed by someone else, like a developer, agency or plugin, without telling anyone.

What Preventionlabs shows

Every report's DNS section checks DNSSEC (on, off or broken), the number of nameservers, CAA certificate limits, IPv6, records pointing at services that no longer exist, mail servers with no address, the registry record (when the domain expires and whether transfers are locked), and whether the site accepts connections over both IPv4 and IPv6.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free