Check DNS and email security

Security Advisor is a built-in checkup for each DNS zone that looks at the records email and security depend on, so you can catch problems before they cause trouble. It's for anyone managing a domain, even if you're not familiar with DNS.

Overview

• It reads your domain's live DNS records, so it's accurate no matter who manages them.
• Each check shows a clear status and a plain explanation of why it matters.
• Your overall security status also shows in the zone list, so you can scan your whole portfolio at a glance.

Run the advisor

1. Open a zone from the DNS page.
2. Look at the Security Advisor. Each check shows a clear status and a plain explanation of why it matters.

What it checks

• SPF — the sender policy that stops your domain being used to spoof email.
• DMARC — tells receiving mail servers what to do with unauthenticated mail.
• DKIM — checks for DKIM email signing.
• MX — whether mail is actually set up for the domain.
• DNSSEC — whether the zone is cryptographically signed against tampering.
• CAA — which certificate authorities are allowed to issue certificates for the domain.

NoteThe CAA check works together with your SSL certificates (it controls who can issue them), and the SPF/DMARC/DKIM/MX checks protect your email deliverability.

Tips

TipIf a check fails, look for an Apply fix or Fix this → option next to it — many issues can be resolved with a single click instead of editing records by hand.