I am launching a new website
Check the domain resolves on both the bare name and www, the certificate covers both, and email is not left open to spoofing.
AltF DomainOps
Domain launch checklist
Before a new site goes live, the domain needs more than an A record. This checklist covers the 20 things that most often go wrong at launch, in the order to do them, with a DomainOps check for each so you can confirm instead of hoping.
- Free, no sign-up
- Real DNS, RDAP and TLS data
- Raw records shown
- No affiliate links
1. Registration
- Registrar account uses two-factor sign-in and an email address on a different domain.
- Auto-renew is on and the expiry is more than a year away (check: domain expiry check).
- Transfer lock (clientTransferProhibited) is on.
2. DNS
- At least two nameservers, and the registry's NS list matches your DNS host (check: NS lookup).
- A (and AAAA if your host supports IPv6) at the bare domain.
- www resolves, and one of the two redirects to the other.
- TTLs of 300-3600 seconds while you are still changing things.
- DNSSEC on, with the DS record at the registrar (check: DNSSEC check).
3. HTTPS
- Certificate covers both the bare domain and www (check: SSL certificate check).
- HTTP redirects to HTTPS in one hop.
- CAA lists the authority your host uses (check: CAA record check).
- Security headers set, starting with HSTS (check: website security check in AltF Security).
4. Email
- MX points at your mail provider, or a null MX if the domain sends and receives no mail.
- One SPF record listing every service that sends as you, ending in ~all or -all, under 10 lookups.
- DKIM turned on at each sending service.
- DMARC at p=none with a rua address, moved to quarantine or reject after reviewing reports.
5. After launch
- Run the health report and fix every red finding.
- Add the domain to the DomainOps watchlist.
- Submit the site to Google Search Console (the TXT verification shows in the TXT lookup).
- List the site where people discover new tools and sites; the AltFTool backlinks directory is a starting list.
Check each step with the tools below.
Domain health report
About 30 DNS lookups and the registry's RDAP record, scored with a plain-language finding and a fix for each check.
The report reads public DNS and registry data only. The website itself is never contacted, and AltFTool keeps no record of the domains you check.
Domain launch checklist: questions and answers
What is the minimum DNS a new website needs?
Two nameservers, an A record at the bare domain, a www record, and, if the domain will send email, MX, SPF and DMARC. Everything else improves security or reliability.
Should the main address be www or the bare domain?
Either works. Pick one, redirect the other to it with a 301, and use the same one in Search Console and your sitemap.
Start from what you are doing
My email goes to spam
Read your SPF, DMARC and DKIM records, make sure SPF stays under 10 lookups, and confirm MX points at the right provider.
I am moving to a new host
Lower TTLs first, copy every record, switch nameservers, then compare resolvers until the new answers appear everywhere.
My site shows a certificate error
See whether the certificate expired, does not cover this hostname, or is missing an intermediate in the chain.
I do not want to lose my domain
Find the real expiry date, check transfer lock is on, and keep the domain on a watchlist with a countdown.
A service asked me to add a TXT record
Confirm the verification record is live, see which services already verified the domain, and spot leftovers to remove.
Focused checks and guides
Checks
Full domain health checkAll nine tools, the record glossary and how each check works.DNS lookupFree DNS lookup for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY and HTTPS records, with TTLs, DNSSEC status and what each record means.MX lookupFree MX record lookup: see a domain's mail servers in priority order, which email provider runs them, and whether SPF and DMARC are set.NS lookupFree nameserver lookup: see which nameservers answer for a domain, who the DNS host is, the SOA serial, and whether the zone is DNSSEC-signed.TXT record lookupFree TXT record lookup that labels each record: SPF, Google and Microsoft verification, Meta, Apple, Stripe and 25 more services, plus DMARC and DKIM.SSL certificate checkFree live SSL checker: connect to any site and see its certificate issuer, expiry date and days left, covered hostnames, chain trust and TLS version.Domain expiry checkCheck when a domain expires from the registry's own RDAP data: expiry date, days left, registrar, transfer lock and status codes in plain English.Reverse DNS lookupFree reverse DNS lookup for IPv4 and IPv6: find the PTR hostname of an IP address and the network owner from the regional internet registry.DNSSEC checkCheck whether a domain uses DNSSEC: DS record at the registry, DNSKEY in the zone and whether public resolvers validate the answers.CAA record checkLook up a domain's CAA records to see which certificate authorities may issue certificates, including wildcard and reporting rules, with fixes.
Guides
Website migration DNS checklistMove a website or DNS to a new host without downtime: lower TTLs, copy records, switch nameservers, watch resolvers, handle DNSSEC and email.Email domain setup guideSet up email for your domain the right way: MX records, one SPF record under 10 lookups, DKIM keys, a DMARC rollout plan, MTA-STS and BIMI.
25 more free domain and DNS tools
Single-purpose AltFTool tools for one job each, grouped by what you are trying to do.
Lookups
One question, one answer.
Write records
Generate correct records before you paste them into your DNS host.
Certificates and HTTPS
Go deeper than the live certificate check.
AltFTool does not store the domains or addresses you check. DNS lookups in the DNS, compare, email and IP tools run from your browser; registration, report and certificate checks pass through AltFTool's server and keep nothing.