Module 8 · 8.3
Online DNS tools
Module 8: Security and troubleshooting · Reading time: 7 minutes
Learning objective: After this lesson, you'll be able to choose the right online tool for any question about your DNS and know how to read the result.
Key concepts: online dig, DNS checker per country, internet.nl, DNSViz, Zonemaster, MXToolbox, mail-tester, email check, domain health
Why use online tools?
An online tool asks your question from a different location than your own computer. That has two advantages. You're not affected by the cache of your own computer or router, and you see what the rest of the internet sees. What's more, many tools combine dozens of checks in a single click, whereas with dig you'd have to ask each question separately.
There isn't one tool that does everything best. Choose based on your question.
Which tool for which question?
| Your question | Suitable tool | What you see |
|---|---|---|
| "What exactly does the DNS return right now?" | Google Admin Toolbox Dig (toolbox.googleapps.com/apps/dig), or another online dig | The same as dig, without installing anything |
| "Does the whole world already see my change?" | dnschecker.org (or similar "DNS propagation checkers") | The answer from dozens of resolvers in different countries side by side |
| "Is my domain set up in a modern and secure way?" | internet.nl (from the Dutch Internet Standards Platform) | Score for website (IPv6, DNSSEC, https) and email (DNSSEC, SPF, DKIM, DMARC, STARTTLS/DANE) |
| "Is my DNSSEC chain correct?" | DNSViz (dnsviz.net) | A diagram of the chain from the root to your domain, with errors in red |
| "Is my zone technically set up correctly?" | Zonemaster (zonemaster.net) | Thorough check of nameservers, delegation, SOA and DNSSEC |
| "How do my mail records look?" | MXToolbox, an email check (for example WebOké's email check), or your mail provider's checks | MX, SPF (with number of lookups), DMARC, blacklists |
| "Does my sent mail arrive properly?" | mail-tester.com, or a test email to Gmail using "Show original" | Whether SPF, DKIM and DMARC pass for a real email |
| "Do website and mail work together, all in one overview?" | A domain health check (for example WebOké's Domain Health) | Nameservers, A record, www, certificate, MX, SPF, DMARC, DNSSEC and CAA in a single list |
WebOké's tools are shown here as an example of an "all in one" check; other hosting providers and registrars have similar tools. If in doubt, use two side by side: if two independent tools say the same thing, it's almost certainly correct.
Using an online dig
An online dig does exactly what you learned in lesson 8.2. You enter the name (for example _dmarc.example.com), choose the type (TXT) and get the raw output. Google's toolbox also shows the status (NOERROR, NXDOMAIN, SERVFAIL) and the TTL. Use this tool when you want to know exactly what's set, for example to check that your SPF record appears exactly once.
Reading a DNS checker per country
After a change, a checker such as dnschecker.org will often show a mixed picture: in some countries the new address with a green tick, in others still the old one. That's not an error. Each resolver fetched the record at a different time and is counting down its own TTL (lesson 6.2).
Two things to watch for:
- Do you see the old answer everywhere, even long after the TTL? Then the change probably isn't on the nameserver the world actually uses. Check which nameservers your domain has (lesson 2.1).
- Do some resolvers show nothing (a cross)? That could be a SERVFAIL, often caused by DNSSEC. Check with DNSViz in that case.
internet.nl
internet.nl is an independent test from the Dutch Internet Standards Platform (including SIDN, NLnet Labs and the Dutch government). There are three tests: website, email and your own connection. The result is a percentage with explanations per component and a "How to improve" section.
Read the result with judgement: not every red item is an outage. If, for example, DANE or IPv6 is missing, your mail or site simply still works, but you don't meet the latest standard. Red on "DNSSEC valid" or "SPF" does matter, though.
DNSViz
DNSViz draws the chain of trust from lesson 8.1: blocks for the root, the TLD and your domain, with arrows for DS and DNSKEY. Blue is secure, black means unsigned (not an error) and red is broken; how to read the diagram is explained in lesson 8.1. Red lines or red blocks show exactly where the chain breaks, for example "DS has no matching DNSKEY". That's the tool to reach for when you get SERVFAIL and dig +cd does give an answer.
Zonemaster
Zonemaster (built by, among others, the registries of .se and .fr) checks your zone the way a registry does: are there at least two nameservers, do they all give the same answer, does the SOA serial number match everywhere, are the nameservers reachable over IPv4 and IPv6. Handy before you change nameservers at a registry that checks strictly. You can also test nameservers that aren't linked to the domain yet ("undelegated test").
Mail tools
An email check looks at the DNS side: is there an MX, is there exactly one SPF record, does it stay within the ten lookups, is there a DMARC record. It can't see whether DKIM works, because for that you need to know the selector. You test that with a real email: send one to mail-tester.com or to a Gmail address, and check under "Show original" whether SPF, DKIM and DMARC show PASS.
In practice: what it looks like in a panel
Many panels have their own check. In My WebOké, the domain page shows the Domain / Email Health card, with green, orange and red dots and sometimes a repair button. In Cloudflare, you see notices at the top of your DNS overview; Google Workspace and Microsoft 365 have a check page in their admin centre. Such checks know your situation best; an independent tool shows what the outside world sees. Use them together.
Summary
- Online tools ask from a different location and aren't affected by your cache.
- Online dig: what's literally set. DNS checker per country: has the world seen it yet. DNSViz: is the DNSSEC chain correct. Zonemaster: is the zone technically correct. internet.nl: is it set up in a modern and secure way.
- An email check tests the records; a real test email tests whether SPF, DKIM and DMARC pass.
- Use two tools side by side if you're in doubt.
Quiz
Exercise
Exercise Z8.3: Online tools. Test internet.nl with internet.nl's own website and email test. Note down, for the email test, whether DNSSEC is valid for the mail servers (MX), and look up in DNSViz which algorithm number the DS records of internet.nl use. Then use an online dig to check which policy (p=) the DMARC record of internet.nl has. Fill in your answers.
Further reading
These articles describe WebOké's checks; the independent tools work for any domain.