DNS Health Check: Records, DNSSEC, CAA & Nameservers

A fast best-practice audit of a domain's DNS. Give it domains; for each it resolves the core records over keyless DNS-over-HTTPS and checks the things that matter — does it resolve, does it have enough redundant nameservers, DNSSEC, a CAA record, IPv6, and SPF/DMARC — into a health signal with specific findings. Keyless, agent-callable, built to answer "is this domain's DNS set up right?"

🔎 Read-only public DNS. It queries DNS over DoH — it never contacts the domain's own servers. Findings are recommendations, not a verdict.

⚡ Why it's useful

DNS misconfigurations cause outages and security gaps quietly: a single nameserver provider, no DNSSEC, no CAA (so any CA can issue certs for you), email set up without SPF/DMARC. This surfaces them all in one call with a clear pass/warn per check.

📋 What each report contains

Field	Meaning
signal	healthy / ok-with-recommendations / needs-attention
score	Checks passed out of total
records	Resolved A/AAAA, MX, NS, CAA, and DNSSEC / SPF / DMARC presence
checks	Each best-practice check with pass / warn / fail and detail
findings	The specific warnings and failures to act on

Checks: resolves, IPv6, nameserver count, nameserver provider diversity, DNSSEC, CAA, SOA, and (if email is configured) SPF and DMARC presence.

📥 Input

{ "domains": ["example.com", "your-brand.org"] }

Set onlyProblems: true for scheduled alerting. One report per domain.

📤 Example output (real run, trimmed)

{ "domain": "github.com", "signal": "ok-with-recommendations", "score": "6/8",
  "records": { "dnssec": false, "caa": ["0 issue \"digicert.com\""], "spf": true, "dmarc": true },
  "findings": ["No IPv6 (AAAA) record.", "DNSSEC not enabled."] }

In the same run apify.com scored 8/8 (healthy), and example.com was flagged for a single nameserver provider and a missing CAA record.

💰 Pricing (pay-per-event)

• Domain checked — $0.015 per domain.

💡 Use cases

• IT / ops / DevOps: a quick DNS hygiene audit across every domain you run.
• Agencies / MSPs: check a whole client portfolio's DNS best practices from one place.
• Security / due diligence: catch missing DNSSEC/CAA and single-provider nameserver risk.
• Agents: callable as an MCP tool — give it domains, get back a DNS health report.

🔑 Keyless & agent-callable

No API keys, no accounts, no paid child Actors — just public DNS over DoH.

🚀 Ready-made tasks (one click)

• DNS Health Checker - Records, Nameservers & Score

🤖 For AI agents (MCP)

https://mcp.apify.com/?tools=actors,docs,centorprat/dns-health-check

Loads as centorprat--dns-health-check. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/dns-health-check