A health report hands you a wall of grades: DNS, mail, security, DNSSEC, and more. Knowing your score is one thing; knowing which red item to fix first is what actually protects your domain. This is the companion guide to the Domain Health Report. Run yours, then use this to decode each section and work the fixes in the order that matters.
What the overall grade is really telling you
The top-line grade is a weighted roll-up, not a simple average. A domain can look mostly green and still earn a mediocre overall grade because one heavily weighted item, usually something that breaks mail delivery or leaves you spoofable, drags it down. So do not chase the letter grade. Read the sections, find the reds and yellows, and fix them in priority order. The letter fixes itself once the real problems are gone.
The sections, decoded
DNS resolution and nameservers
This checks that your domain resolves, that your nameservers agree with each other, and that the delegation from the parent zone matches what your nameservers actually serve. A failure here is the most serious kind, because if DNS is broken, nothing else works. Common flags: nameservers that disagree (a stale one still answering), missing glue records, or a lame delegation where a listed nameserver does not actually answer for the zone.
What it means for you: green here is table stakes. Any red in this section outranks everything below it.
Mail (MX, SPF, DKIM, DMARC)
This is usually where the points are lost, and where the most damage hides. The report checks that you have MX records, a valid SPF record, DKIM signing, and a DMARC policy.
- MX present and reachable: where your mail is delivered. Missing means you cannot receive mail.
- SPF valid: lists who may send as your domain. Watch for a soft or missing policy, or too many DNS lookups.
- DKIM present: cryptographically signs your mail so receivers can verify it.
- DMARC policy: tells receivers what to do with mail that fails SPF and DKIM. A policy of "none" monitors but enforces nothing.
What it means for you: if these are weak, your mail lands in spam and anyone can spoof your domain. This section usually holds your fastest, highest-impact wins. When SPF is the flag, the SPF checker shows exactly which record is published and how many lookups it costs.
Security and DNSSEC
DNSSEC cryptographically signs your DNS answers so a resolver can detect tampering. The report tells you whether it is enabled and whether the chain of trust is intact. A common trap is a partially deployed or broken DNSSEC setup, which is worse than none because it can make your domain fail to resolve for validating resolvers.
What it means for you: DNSSEC off is a yellow, a defensible choice for many domains. DNSSEC broken is a red you must fix immediately, because it can take your domain offline.
TLS and web-facing checks
If the report inspects your web endpoint, it flags expired or misconfigured certificates, missing HTTPS redirects, and weak protocol versions. An expired certificate throws a browser warning that scares off every visitor.
What it means for you: an expired cert is an emergency; a missing HSTS header is a nice-to-have.
Fix in this order
Grades tempt you to fix whatever is reddest. Fix by blast radius instead:
- Anything breaking resolution. Broken DNS delegation or broken DNSSEC first, always. If the domain does not resolve, nothing else matters. A broken DNSSEC chain belongs at the very top because it can silently take you offline for validating users.
- Missing or broken MX. If you cannot receive mail, that is a business emergency, second only to the domain not resolving.
- SPF and DKIM. These stop your outbound mail from being marked spam and are the foundation DMARC depends on. Fix them before touching DMARC.
- DMARC policy. Once SPF and DKIM pass, add or tighten DMARC to stop spoofing. Do this after the two checks above, not before, or you will bounce your own legitimate mail.
- Expired TLS certificate. Fix promptly; it scares visitors but does not break DNS or mail.
- Everything else (DNSSEC if currently off, security headers, minor hygiene) as time allows.
The logic: an item's priority is how badly its failure hurts, not how alarming the color looks. A missing security header is red on some scanners but harms you far less than a soft SPF record.
A trap to avoid
Do not enforce DMARC before SPF and DKIM are solid. A common self-inflicted outage is setting DMARC to reject while a legitimate sender (your CRM, your invoicing tool, your newsletter) is not yet covered by SPF or DKIM. You end up blocking your own mail. Get alignment right first, watch the DMARC reports, then tighten the policy.
Rescan and confirm
After each fix, rerun the Domain Health Report rather than assuming the change took. DNS changes take time to propagate based on your record TTLs, so a fix may not show green immediately; give it the TTL window before you conclude it failed. Work the priority list top to bottom, rescan between changes, and the overall grade climbs on its own as the items that actually matter go green.