Documentation
Domain health
Domain Health scans a domain’s DNS, TLS certificate, email authentication (SPF, DKIM, DMARC), and registration expiry, then rolls the results into a single 0–100 score so you can see problems — and creeping expiries — before they bite.
Run a scan
Open Domain Health in the sidebar, enter a domain, and run the scan. Results are saved to your team so you can track the domain over time and get alerted on changes.
There's also a free public scan on the marketing site that anyone can run without an account — same checks, but nothing is saved and connected-provider data isn't included.
What gets checked
| Check | What it looks at |
|---|---|
| DNS records | A, AAAA, CNAME, MX, NS, TXT — missing A or NS is critical, missing MX is a warning |
| SSL / TLS | Certificate issuer, protocol, and days to expiry (under 14 days is critical) |
| SPF | A v=spf1 TXT record; a +all policy is flagged as critical |
| DMARC | A _dmarc policy — p=reject/quarantine is healthy, p=none is a warning, missing is critical |
| DKIM | Common selectors for the detected email provider |
| BIMI | A default._bimi record, if present |
| Domain expiry | Registration expiry via RDAP/WHOIS — within 30 days is critical |
| DNSSEC | DNSKEY presence (informational; drives change alerts, not the score) |
How the health score works
The score is a weighted average across DNS, email authentication, DMARC, SPF, SSL, DKIM, and domain expiry. Each category's result (healthy, warning, critical, and so on) scales its contribution, then the total is expressed out of 100:
- 80–100 — Healthy
- 60–79 — Needs attention
- Below 60 — At risk
Connect a DNS provider (optional)
Connecting your DNS provider unlocks deeper analysis: full zone snapshots, change detection between scans, and a richer set of configuration issues. Access is read-only — Crowswatch never makes DNS changes — and credentials are encrypted with AES-256-GCM.
Steps
- Go to Domain Health → Connect and choose your provider.
- Enter the credentials the provider needs (for Cloudflare, an API Token scoped to
Zone.DNS:ReadandZone.Zone:Read). - Crowswatch validates the credentials and lists your zones; pick the zone for this domain.
- Save. The domain is now linked to the provider and will build DNS snapshots on each refresh.
Per-domain detail
Open a domain to see its latest DNS snapshot (with a diff of what changed since last time), and its open issues ordered by severity — critical, warning, advisory, and info — each with a description and recommendation. You can snooze an issue for a while if it's expected.
Automatic re-scans
Domains with auto-scan enabled are re-checked on an interval (default every 60 minutes; faster intervals are available on paid plans). When a scan detects a change — a new DNS record, an approaching expiry, a weakened DMARC policy — it can dispatch alerts through your channels.
Permissions
Domain data is scoped to the active team. Owners and admins add domains, connect providers, set the scan interval, and snooze issues; members have read-only access. The number of tracked domains is governed by your plan.
Troubleshooting
The scan can’t resolve my domain
Crowswatch tries public resolvers, the system resolver, then DNS-over-HTTPS. A persistent failure usually means the domain has no NS/A records or the registrar has suspended it — the scan will flag that as critical.
Provider validation fails
Double-check the token and any extra fields, and that the token has read access to zones/DNS. Error messages are intentionally generic; regenerate the token if it can’t be validated.
My DMARC shows a warning even though it exists
A p=none policy is monitor-only and is flagged as a warning; move to p=quarantine or p=reject once you’ve confirmed your legitimate senders pass.