DNS go-live checker
Before you point visitors at a new server, check what DNS really answers: whether the name resolves to your server's address, whether the resolvers already agree, and whether anything will stop the certificate. Your browser asks two public resolvers directly; nothing goes through or stays with ANAROQ.
What it does
It asks two public DNS-over-HTTPS resolvers, from your browser, for the A, AAAA, CNAME, MX, TXT and CAA records of a domain, and checks them against the address of the server you are about to launch: the address matches, both resolvers agree, the caches will not hold an old address for hours, no CNAME sits at the root, and CAA lets Let's Encrypt issue the certificate that Caddy, Traefik or Certbot will ask for.
How it works
- Enter the domain name, and the server's public IPv4 address (and IPv6, if it answers on IPv6).
- Read the notice: pressing the button sends the name to the two resolvers listed there.
- Press Check DNS. Each record type is asked of each resolver at the same time, in a few seconds.
- Read the findings, most serious first, each with what to change. After a change, check again once the TTL has passed.
What it checks
- The name exists and has an address
- NXDOMAIN, SERVFAIL (often a broken DNSSEC chain) and a name with no A or AAAA record are errors: nobody can reach the site.
- The expected address
- A and AAAA are compared with the addresses you entered: a different address is an error, an extra one is a warning, and AAAA records you did not check are reported, because IPv6 visitors use them first.
- Propagation
- If the two resolvers answer differently, one of them still holds the old answer until its TTL expires. Without an expected address this is shown as information only, because a CDN may answer by location.
- TTL
- Address records cached for more than an hour mean a move reaches some visitors only hours later: lower the TTL before you move.
- CNAME at the root
- A CNAME cannot sit next to the records a root domain needs. Providers offer ALIAS, ANAME or CNAME flattening instead.
- CAA
- The CAA records of the name, or of the nearest parent that has them, must allow letsencrypt.org, or the automatic certificate is refused.
- Private addresses
- A record that points to a private, loopback or link-local address cannot be reached from the internet.
Example
app.example.com moved to a new server (203.0.113.10) an hour ago. Cloudflare already answers with the new address; Google still answers with the old one, cached for almost four hours. An AAAA record from the old server is left, and the parent domain's CAA allows only DigiCert. These are the checker's real findings for these answers:
Result for app.example.com
What each resolver answers
| Resolver | Status | A | AAAA |
|---|---|---|---|
| Cloudflare 1.1.1.1 | Answered | 203.0.113.10 | 2001:db8::7 |
| Google Public DNS | Answered | 198.51.100.7 | 2001:db8::7 |
Records
As Cloudflare 1.1.1.1 answered. TTL is the time the resolver may still keep each record.
| Type | Name | Value | TTL (s) |
|---|---|---|---|
| A | app.example.com | 203.0.113.10 | 300 |
| AAAA | app.example.com | 2001:db8::7 | 300 |
- app.example.com is treated as a subdomain.
- The CAA records that apply are at example.com.
Findings
4 findings: 0 error, 1 high, 2 medium, 0 low, 1 info.
High1
- HighAQ-DNS-009
The CAA records at
example.comallow only digicert.com to issue certificates: Let's Encrypt (Caddy, Traefik, Certbot) will be refused.Fix: Add a CAA record
0 issue "letsencrypt.org"atexample.com(keep the others if you still use those CAs).
Medium2
- MediumAQ-DNS-006
app.example.comalso has AAAA (IPv6) records: 2001:db8::7. Visitors with IPv6 connect there first, not to the IPv4 address you expect.Fix: Fill in the server's IPv6 address above to check it, or delete AAAA records left from an old server or a parking page.
- MediumAQ-DNS-007
The resolvers disagree on A: Cloudflare 1.1.1.1 returns 203.0.113.10, Google Public DNS returns 198.51.100.7.
Fix: Right after a change this is propagation: resolvers keep the old answer until its TTL expires. If it lasts longer than the TTL, check that every NS server of the domain serves the same zone. A CDN can also answer by location on purpose.
Info1
- InfoAQ-DNS-011
The address records are cached for up to 13980 seconds (about 3.9 hours): after a change, some visitors keep reaching the old address that long.
Fix: Before you move to a new server, lower the TTL (for example to 300) and wait out the old one; raise it again after the move.
Limits
- It sees what two public resolvers answer from where you are, not every resolver in the world, and not your visitors' caches.
- TTL is what the resolver may still keep, not necessarily the value set in your zone.
- Whether a name is a root domain is decided without the Public Suffix List: two labels (example.com), or three under a common second-level label (example.co.il). Other cases may be misjudged.
- It does not connect to the server: TLS, ports and HTTP need a check from a server, which is not available yet.
- Only issue records are checked against Let's Encrypt; issuewild (wildcard certificates) is shown but not checked.
Methodology: how the numbers are worked out
Sources
Related
Next step
A free public tool by ANAROQ, a company building compute infrastructure. What ANAROQ is building