Domain Health.
One check across everything a domain needs to get right: DNS, the SSL/TLS certificate, the HTTP front door and email authentication. Four real checks run in parallel from this server, graded, with every finding explained and a link into the full tool for the detail.
About this check
Domain Health runs the four server-side tools on this site against one domain at the same time and condenses each into a grade and its most important findings. It is the check to run after a DNS change, a certificate renewal, a migration to a new host or mail provider, or when someone says "the site seems off". Nothing is stored; run it again whenever you like.
What it checks
| Pillar | Findings | Full tool |
|---|---|---|
| DNS | A and AAAA records at the apex, nameserver count, CAA. Real queries to Cloudflare's resolver, so a propagating change shows as it is right now. | DNS lookup |
| SSL/TLS | Chain trust and missing intermediates, hostname match, days to expiry, TLS 1.3 support, legacy TLS 1.0/1.1 still enabled, OCSP stapling. From a live handshake, not a certificate transparency search. | SSL certificate checker |
| HTTP | Whether http:// redirects to https:// and with which code, redirect chain length, final status, HTTP/2, compression, and the security header grade from the HTTP checker. | HTTP header & redirect checker |
| MX and STARTTLS, SPF with the 10-lookup count, DMARC policy, DKIM keys under common selectors, MTA-STS, TLS-RPT and BIMI. The email checker's own findings, condensed. | Email deliverability checker |
How the grade works
Each pillar is graded on its own findings: A is clean, B has a warning or two, C is warnings only, D has one failure and F more than one. The overall grade applies the same rule across every finding. A domain that sends no mail and says so with a null MX is graded on what it does publish, so it is not penalised for the absence of SPF or DKIM. Info findings never affect the grade.
What to do with the result
- Failures first. They are sorted to the top of each pillar. An expired certificate, a missing intermediate, no HTTPS redirect and no DMARC are the ones that cost you visitors or mail today.
- Open the full report for any pillar. Domain Health shows the headline; the tool behind it shows the chain, the SPF tree, every header and every hop.
- Read the guide linked from a finding when you want the why: certificate chains, the SPF lookup limit, DMARC policies, redirect codes, security headers.
- Re-run after a fix. DNS changes take as long as the old TTL; everything else is immediate.
From the command line
curl "kirkdiamond.com/domain-health?domain=example.com" prints the same report as text; add &format=json for the structured version, which is the shape a monitor or a CI step would consume. Only public domains can be checked and the check is rate limited per visitor.