Module 8 · 8.5
Checklist for your own domain
Module 8: Security and troubleshooting · Reading time: 10 minutes
Learning objective: After this lesson, you'll be able to check your own domain from top to bottom with a fixed checklist, and know which point to start at when the website or mail isn't working.
Key terms: registration, nameservers, A/AAAA, www, certificate, MX, SPF, DKIM, DMARC, CAA, DNSSEC, TTL, backup
Why top to bottom?
DNS is a chain: without registration there are no nameservers, without working nameservers there are no records, without an A record there's no website. A fault at the top causes all kinds of complaints lower down. That's why you always work through the list in this order and stop at the first point that isn't right. Fix that first, then start again from the top.
The list uses example.com: replace it with your own domain. Each point includes a dig command; an online dig tool (lesson 8.3) works too. A domain health check, such as the one from your hosting provider or the free Domain health tool, covers a large part of this list in one go, but it's useful to know what's behind it.
Part A: the foundation
1. Is the domain registered and active?
- How: a whois or RDAP lookup (for example via the registry's website, such as sidn.nl for .nl), or
whois example.com. - Good: status active (for .nl: "active"), not "in quarantine", not expired. The registrant is correct.
2. Which nameservers does the domain have, and are there at least two?
- How:
dig +short NS example.com, and for what the registry passes on,dig +trace example.com. - Good: at least two nameservers, from the provider where you manage your DNS.
3. Do all nameservers respond, and do they give the same answer?
- How:
dig +short SOA example.com @<nameserver>for each nameserver. - Good: every nameserver responds (no timeout, no REFUSED) and the serial number (third field of the SOA) is the same everywhere. A nameserver that doesn't respond for your domain is called lame.
4. Is DNSSEC correct (if it's turned on)?
- How:
dig +short DS example.comanddig example.com A @1.1.1.1(check the status and theadflag); if in doubt, use DNSViz. - Good: either no DS (DNSSEC off, which works fine), or a DS with status NOERROR and the
adflag. Wrong: SERVFAIL.
Part B: the website
5. Does the domain name point to the right server?
- How:
dig +short A example.comanddig +short AAAA example.com. - Good: the IPv4 address (and, if you have one, the IPv6 address) of the server where your website is hosted. No old AAAA record from a previous server.
6. Does www work?
- How:
dig +short A www.example.com(orCNAME). - Good: an A record, AAAA record or CNAME that leads to the same site. If www is missing, people who type www will get an error message.
7. Does the site have a valid certificate for both names?
- How: open
https://example.comandhttps://www.example.comand click the padlock, or use the website test at internet.nl. - Good: no warning, the certificate is valid for at least a few more weeks and covers both names.
8. Is your certificate issuer allowed to issue certificates (CAA)?
- How:
dig +short CAA example.com. - Good: no CAA record (anyone is allowed), or a CAA record with
issuefor the provider that issues your certificate. Wrong: a CAA record that doesn't mention your issuer.
Part C: email
9. Where does your mail arrive?
- How:
dig +short MX example.com, thendig +short A <mailserver>for the first name. - Good: the MX records of your current mail provider, and no leftover MX from an old provider. Every mail server name has an A or AAAA record. If you don't use the domain for mail, a null MX (
0 .) can make it clear that no mail is received.
10. Is there exactly one correct SPF record?
- How:
dig +short TXT example.comand look at the lines starting withv=spf1; an email check counts the lookups. - Good: exactly one SPF record, with all services that send mail on behalf of your domain, ending in
~allor-all(never+all), and no more than ten DNS lookups.
11. Is DKIM set up for every service that sends mail?
- How:
dig +short TXT <selector>._domainkey.example.com(orCNAME) for every selector you know, such as the one from your mail provider and your newsletter service. You'll find the selector in the service's instructions or in the headerDKIM-Signature: ... s=<selector>of a sent email. - Good: each record gives a key (
v=DKIM1; ... p=...) or a CNAME to the service, and a test email shows DKIM PASS.
12. Is there a DMARC record?
- How:
dig +short TXT _dmarc.example.com. - Good: exactly one record starting with
v=DMARC1with a valid policy (p=none,p=quarantineorp=reject). Started withp=none? Then plan to tighten it.
13. Does a real email arrive correctly?
- How: send an email to mail-tester.com or to a Gmail address and view "Show original".
- Good: SPF, DKIM and DMARC all show PASS.
Part D: maintenance
14. Are the TTLs sensible?
- How:
dig example.com A @<your nameserver>and check the TTL. - Good: normally 3600 to 86400 (one hour to one day). Only temporarily 300 around a planned change. Forgetting to set it back after a migration isn't a disaster, but it does cause unnecessary extra traffic.
15. Do you have a backup of your zone?
- How: the backup or export button in your DNS panel, or
digper record if you don't have one. - Good: a recent copy of all records, stored outside the panel.
16. Are there no forgotten records?
- How: go through all records in your panel.
- Good: no verification records or subdomains for services you no longer use. A CNAME pointing to a cancelled service can be "taken over" by someone else (subdomain takeover): remove it.
Where do you start with a complaint?
| Complaint | Start at | Then |
|---|---|---|
| "The website isn't working" | 1, 2, 4 | 5, 6, 7 |
| "I still see the old website" | 5 (with @<nameserver> and @1.1.1.1) | your own cache (lesson 8.2) |
| "I'm not receiving mail" | 1, 2, 4 | 9 |
| "My mail ends up in spam" | 10, 11, 12 | 13 |
| "A service can't verify my domain" | 2 (am I editing it in the right place?) | the requested record, with the name as in lesson 8.4 mistake 2 |
| "No certificate" | 5 | 8, and the proxy setting (lesson 8.4 mistake 9) |
In practice: what it looks like in a panel
A domain health check automatically covers a large part of this list. In My WebOké, this is shown on the domain page as a card called Domain / Email health, with green, orange and red per point; the public version works for any domain. Other hosting providers, registrars and DNS providers have similar checks, and internet.nl independently tests a large part of parts B and C. Use such a check as a starting point, and this list to understand what's showing red.
Summary
- Work through the list from top to bottom and stop at the first point that isn't right.
- Foundation: registration, nameservers, matching answers, DNSSEC.
- Website: A/AAAA, www, certificate, CAA.
- Mail: MX with address, one SPF, DKIM per service, one DMARC, test email.
- Maintenance: TTL, backup, clean-up.
Quiz
Exercise
Exercise Z8.5: Final exercise: your own domain. Check your own domain using this checklist. Enter your domain name in the course environment and answer, for each point in parts A, B and C, what you found (for example your nameservers, your MX, your SPF record and your DMARC policy). The program runs the same checks and compares the results. If something isn't right with your domain, you'll get an explanation with a reference to the relevant lesson. If you don't have your own domain, use sidn.nl.
Further reading
These articles describe the checks at WebOké; the checklist works for any domain.
- WebOké manual 5.17: Domain and email health: checking and fixing
- Website or email not working after a move or DNS change: check your domain
- WebOké manual 5.7: Restoring DNS and creating a DNS backup
- Making and restoring a backup of your DNS
- Free tool Domain health: https://www.weboke.hu/en/domain-health
- Free Email check: https://www.weboke.hu/en/email-check