About

About DNSChecker and how our tools work

DNSChecker.co.za is a free set of DNS, email and blacklist tools provided by HostFaddy. This page explains exactly what each tool does, where its data comes from and what it can't tell you.

Last updated

Who runs DNSChecker.co.za

DNSChecker.co.za is provided by HostFaddy, a South African company offering web hosting, VPS and reseller hosting, domain registration and transfers, web development and mobile app development. HostFaddy is an accredited .co.za domain registrar with the ZA Central Registry (ZACR).

We built these tools because DNS and email problems are among the most common support questions we see. They're free to use, need no account, and are also available as the DNSChecker app for iPhone and iPad and Android.

Contact

Found a bug or a result that looks wrong? Email us with the domain and the tool you used and we'll look into it.

How our tools work

DNS propagation checker

Your browser sends each lookup directly over DNS-over-HTTPS (DoH) to three public resolver networks: Google Public DNS (dns.google), Cloudflare (cloudflare-dns.com) and DNS.SB (doh.dns.sb). The tool runs 19 checks across those networks and plots them on a map. These services are anycast — each request is answered by the data centre nearest to you — so the city markers show example locations in each network, not the physical location that answered your query. Results show what these widely used resolvers currently return. They're a strong indication of propagation but can't show the cache of every ISP resolver in the world.

All DNS records lookup

Fourteen record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, DNSKEY, DS, NAPTR and TLSA) are queried in parallel from your browser through Cloudflare's DNS-over-HTTPS service. The export file is generated in your browser; it's not uploaded anywhere.

Email deliverability checker (SPF, DKIM, DMARC, MX)

The domain you enter is sent to a small script on our server, which looks up the records using the server's own DNS resolver. It reports the MX records, the SPF record (flagging missing records, multiple records and weak all settings), the DMARC policy on _dmarc, and DKIM keys for a list of 18 common selectors. If our server can't be reached, the page falls back to checking from your browser via Cloudflare, with a shorter DKIM selector list. The score gives each of the four checks equal weight; “needs work” counts as half. It measures DNS authentication only — not sending reputation or message content. DKIM keys under custom selectors can't be discovered by any tool, so a “not found” DKIM result doesn't prove DKIM is missing.

IP blacklist checker

The IP's octets are reversed and looked up in each blacklist's DNS zone via Google Public DNS over HTTPS. If you enter a hostname, it's first resolved to its IPv4 address through Cloudflare. We interpret each list's return codes: 127.255.255.x answers are error codes (for example, Spamhaus refuses lookups through public resolvers) and are shown as “unavailable”, never as listings; answers outside 127.0.0.0/8 are treated as invalid; and Hostkarma's whitelist codes aren't counted as listings. Lists that have shut down are removed. IPv6 isn't supported yet.

Limitations and disclaimers

  • DNS answers are cached. A result reflects what a resolver returned at that moment; your own ISP may still have older data for up to the record's TTL.
  • Some domains deliberately return different answers in different places (CDNs, geo-DNS, round-robin). Differing results aren't always a fault.
  • Blacklists can change at any time and some restrict lookups from public resolvers. Always confirm a listing on the blacklist's own website before acting on it.
  • The tools are provided free and “as is” for diagnostic purposes. They don't replace checking your DNS provider's control panel or your mail server's logs.

Privacy on this website

  • We don't require an account and we don't sell data.
  • Domain names and IP addresses you check with the propagation, All DNS and blacklist tools are sent from your browser to Google Public DNS, Cloudflare and/or DNS.SB to perform the lookups. Their own privacy policies apply to those requests.
  • Domains checked with the email tool are sent to our server. Like any web server, it keeps standard access logs.
  • Fonts are served from our own server. The world map on the propagation checker loads open-source libraries and map data from the unpkg and jsDelivr content delivery networks.
  • If you dismiss the mobile app prompt, the time you dismissed it is stored in your browser's local storage so we don't ask again for two hours. Nothing is sent to us.

Our full privacy policy also covers the DNSChecker mobile app.