About DNSTrustCheck

DNSTrustCheck is a free diagnostics tool for checking the DNS, mail-routing, and email-authentication health of a domain. It runs live DNS, WHOIS, SMTP, and blacklist checks and rolls the results up into a single weighted health score, so you can see at a glance whether a domain's SPF, DKIM, DMARC, and general DNS hygiene are in good shape, and export the results as an audit-ready PDF report.

Who built this

This site is built and maintained by Gary Thomas, an IT professional with 25 years of experience in the industry. It grew out of the same day-to-day need every IT admin runs into: quickly checking whether a domain's mail is properly authenticated, whether its DNS is clean, and whether anything is quietly broken before a client or colleague notices.

Why a health score

Individual DNS and email-authentication checks are useful on their own, but it's easy to miss the bigger picture. A domain can have a perfectly valid SPF record and still be exposed because DMARC is unset, or have DKIM configured correctly while an old, forgotten CNAME sits pointed at a decommissioned service. The scoring model here weights the checks that matter most for actual deliverability and security (email authentication, blacklist status) higher than informational or emerging checks (DNSSEC, BIMI), so the number reflects real risk rather than a simple pass/fail tally.

How it works

Every check is run live against public DNS, WHOIS, and mail infrastructure at the time you request a scan. Nothing is cached or looked up from a third-party database of stale results. No account or sign-up is required to run a scan.

Why not check every blacklist / every subdomain?

The blacklist check queries a handful of well-known, currently-operating DNSBLs rather than the 100+ lists some tools advertise. Many of those either shut down years ago or exist purely to sell delisting services, and querying them just adds noise (and false "you're blacklisted!" scares) without adding real signal.

Subdomain takeover detection works the same way: it sweeps a fixed list of common subdomain names (www, mail, blog, api, and similar) rather than brute-forcing the full namespace, and checks any that point to a known third-party platform (GitHub Pages, S3, Heroku, Azure, and others) for the tell-tale signs of an unclaimed resource. It's a fast, bounded sweep that catches the most common real-world case (a decommissioned CNAME left pointing at a platform anyone can re-register on), not an exhaustive subdomain enumeration. A clean result means no risk was found among the names checked, not a certified-clear attestation.

Feedback

This tool is under active development. If you spot something that looks wrong, or there's a check you'd like to see added, feedback is always welcome.