What does this report check?
Two things at once, and then the gap between them. On the registration side: registrar, dates, status codes, nameservers on record, and DNSSEC delegation. On the DNS side: the parent delegation and what the zone itself actually publishes.
The report also lists what did not run. A combined check that quietly drops a step is worse than no check, because a gap reads like a pass.
Why do nameservers differ between the registry and DNS?
This is the mismatch worth understanding, because it produces faults that are genuinely miserable to diagnose. A nameserver list can live in three places, and they normally agree.
registry recordparent delegationthe zone itself
When they do not agree, you get answers that work sometimes and fail other times, depending on which server a resolver happened to ask. It usually means a nameserver change was made in one place and not the other, often during a migration that looked finished.
Does DNSSEC enabled mean DNSSEC is working?
No, and the difference matters more than most DNSSEC settings. The registration record tells you whether a DS record exists, which is a delegation fact. It says nothing about whether the signatures validate.
A domain with DNSSEC switched on and a broken chain does not degrade gracefully. It stops resolving completely for everyone behind a validating resolver, while continuing to work fine for anyone who is not. That is why this report flags a signed delegation and sends you to the DNSSEC chain checker, which runs a real validator rather than reading a flag.
Why is my domain registered but not resolving?
If DNS checks come back clean and nothing loads, the answer is often in the registration record rather than in DNS at all.
A hold status tells the registry to stop publishing the domain, so nothing under it resolves while the registration stays perfectly valid. No amount of DNS debugging reveals it, because DNS is behaving correctly by having nothing to serve. The other common cause is no nameservers on record at all. This report is where those two halves finally sit next to each other.
Why is there no score or grade?
Because there is no single correct configuration for every domain, so a total would be inventing a standard that does not exist. A perfectly healthy domain can show several findings, and a domain scoring well can still be badly broken in a way the score never looked at.
Each finding is an observation with the evidence behind it and a link to the tool that investigates it properly. This page is for locating a problem. The focused tools are for diagnosing it.
What this report does not cover
- Website security. No TLS certificates, open ports, blocklists, headers or content checks. This is not a security scanner.
- Email deliverability. Reading a TXT record is not validating SPF, DKIM or DMARC, and pretending otherwise would be worse than staying out of it.
- Monitoring. One point in time, no history, no alerts, and nothing stored.
- Anything private. No registrar account state, no hosting, no billing.
Related tools
The DNS side has much deeper tools of its own: nameserver delegation, SOA consistency and CAA policy. On the registration side, the domain registration lookup shows the complete record and status codes explains anything the report flagged.