When you enter a domain into DomainScan’s DNS lookup, the report pulls every publicly visible DNS record from the authoritative nameservers and public resolvers. Here’s how to read each section.
Overview Section
At the top of every DNS report, you’ll see:
- Domain: the exact domain queried
- Registrar: who the domain is registered with
- Nameservers: the authoritative DNS servers answering queries for this domain
- DNS Health score: an aggregate signal based on record completeness, TTL values, and email authentication status
A healthy domain will show green indicators across all sections. Yellow indicates a warning (e.g., low TTL, missing email auth). Red indicates a problem that needs attention.
A and AAAA Records
These map the domain to IP addresses.
| Field | What to look for |
|---|---|
| Value | The IP address — verify it’s your server/CDN |
| TTL | Under 300s during changes is normal; >86400s is unnecessarily long |
| Multiple records | Multiple A records = load balancing (intentional or accidental) |
| AAAA present | IPv6 support — increasingly important for global reach |
Warning signs: IP address you don’t recognize, TTL of 0 (breaks caching), missing AAAA if you have IPv6 infrastructure.
MX Records
Mail exchange records point to your email servers.
| Field | What to look for |
|---|---|
| Priority | Lower = higher priority; usually 1 primary, 5/10 backups |
| Hostname | Should match your email provider’s documented values |
| Resolution | The report checks that MX hostnames resolve to real IPs |
Warning signs: MX pointing to an IP address directly (invalid), MX CNAME (invalid per RFC), priority 0 for multiple servers (ambiguous), MX resolving to a non-responsive host.
TXT Records
TXT records carry multiple types of data. The report groups them:
SPF Record
v=spf1 include:_spf.google.com ~allCheck: does it include all your sending services? Is the -all or ~all qualifier appropriate? Does it stay under 10 DNS lookups?
DMARC Record
v=DMARC1; p=reject; rua=mailto:dmarc@example.comCheck: is policy p=reject (best) or still p=none (monitoring only)? Is there an rua= address to receive reports?
Domain Verification Records
Google, Microsoft, and other services add verification TXT records when you prove domain ownership. These are safe to leave — they don’t affect email routing.
NS Records
Name server records delegate DNS authority for the domain.
Normal: 2-4 nameservers from your DNS provider (e.g., ns1.cloudflare.com, ns2.cloudflare.com).
Warning signs: Only 1 nameserver (no redundancy), nameservers that don’t match your registrar’s delegation, nameserver that doesn’t respond.
SOA Record
The Start of Authority record has administrative metadata. Pay attention to:
- Serial: Should increment with every zone change. If your SOA serial is old while records have changed, secondary nameservers may not have synced.
- Refresh/Retry/Expire: Typically set by your DNS provider; only relevant if you run your own DNS.
CNAME Records
Aliases from one hostname to another. The report shows both the CNAME value and what it ultimately resolves to.
Warning signs: CNAME chains longer than 3 hops (slow resolution), CNAME loop (infinite redirect), CNAME at the root domain (invalid).
Reading Status Indicators
| Indicator | Meaning |
|---|---|
| Green check | Record found, value looks valid |
| Yellow warning | Record found but potential issue (e.g., weak SPF policy) |
| Red X | Record missing or invalid |
| Gray dash | Not applicable for this domain type |
Exporting and Sharing Reports
Each DNS report has a permanent URL you can share or bookmark. The report is refreshed each time you visit — it always reflects current DNS state, not a cached snapshot.
Use the Export button to download records as JSON or CSV for your documentation or incident response runbooks.
Common Questions
Why does the report show different results than my DNS provider dashboard?
DomainScan queries public DNS resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1) and your domain's authoritative nameservers. Your DNS provider's dashboard shows what they have configured. If there's a discrepancy, it usually means changes haven't propagated yet or there's a caching difference. Wait for TTL expiry and run the report again.
What does 'propagation pending' mean?
DNS changes don't take effect instantly — they spread through the internet's resolver network over time, limited by the old record's TTL (Time to Live). 'Propagation pending' means some resolvers are still returning the old value. Low TTLs propagate faster; typical TTLs of 3600 (1 hour) can take several hours to fully propagate worldwide.
Why are some records missing from the report?
The report queries standard record types. Some specialized record types (like internal records only visible on your LAN) won't appear. Also, DKIM records aren't automatically discoverable — they require knowing the selector prefix. Use the email authentication check which probes common selectors.