zonewatchdog

The things that break quietly.

A domain expires. A certificate lapses. Someone edits an SPF record and mail stops being authenticated three weeks later. None of it fails loudly, and none of it shows up in a deploy. Check a domain and find out what is actually wrong.

Try github.comcloudflare.comnasa.gov

What gets checked

Delegation

Nameservers, SOA, and whether the domain resolves at all.

DNSSEC

Signed, unsigned, or — the dangerous one — signed and failing.

SPF

Every include followed, so the ten-lookup limit is counted properly.

DMARC

Policy, reporting address, and whether p=none is quietly protecting nothing.

DKIM

A probe across the selector names the major providers use.

Mail transport

MTA-STS and TLS reporting, plus null-MX detection.