Your domain is the one asset that takes the website and the email down together. This reads the public registry record — expiry date, registrar transfer lock, nameserver delegation and DNSSEC — and tells you what to fix. No signup, nothing to install.
Domains are usually registered by whoever built the first website, on a personal card, years ago. When it lapses the website and the email go down together — and once it passes the redemption period, anyone can register it. Recovery is not guaranteed at any price.
The registrar lock is one free checkbox that stops a domain being moved to another registrar. Without it, anyone who gets into the registrar account — or the mailbox it sends confirmations to — can take the name, and getting it back is slow, expensive and often unsuccessful.
A single nameserver is a single point of failure for everything the domain does. So is a set left pointing at a provider you stopped paying two years ago. Both are visible from outside and invisible from inside.
Everything here is read from the registry, which publishes it precisely so it can be checked. Check whether anyone can send mail as the domain for the other half.
Domain health FAQ
RDAP — the Registration Data Access Protocol, which is the structured JSON successor to WHOIS. Every generic top-level domain registry is contractually required to publish it, and it is the same data any registrar reads. We look up the right registry endpoint from IANA's official bootstrap file, so a newly delegated TLD works without us changing anything.
A small number of country-code registries still have not adopted RDAP — .io is the most common one people hit. When there is no endpoint listed for the extension, the tool says so rather than guessing. Your registrar control panel will show the same details.
It is a status flag (clientTransferProhibited) that tells the registry to refuse any request to move the domain to a different registrar. It is free, it takes one click, and it blocks the single most damaging attack on a domain: someone who gets into your registrar account, or the mailbox that receives its confirmation emails, moving the name somewhere you cannot reach it. Recovering a transferred domain is slow, expensive, and frequently does not work.
No, and neither can anyone else from outside. Auto-renew is a setting inside your registrar account and it is not published in registry data. That is precisely why the expiry date matters: it is the only part visible from outside, so treat a near date as worth confirming rather than assuming it is handled. Also check that the payment card on file has not expired — a card that lapsed is the usual reason auto-renew silently fails.
Yes. The DNS specification has recommended at least two since 1987, and every managed DNS provider gives you two or more by default. A single nameserver means one outage takes down everything the domain does — website, email, and any service that authenticates against it. Seeing only one almost always means a second was mistyped or dropped at the registrar rather than a deliberate choice.
It is reported here as information rather than a pass or fail, because for most small businesses it is genuinely optional. DNSSEC signs your DNS answers so they cannot be tampered with in transit, which is worthwhile — but a misconfigured rollover takes your entire domain offline, and the risk is real if nobody is watching it. If your DNS provider offers one-click DNSSEC and manages the key rollover for you, turn it on. If it would be hand-managed, get the expiry and lock items above sorted first.
No. RDAP is a public read, the same as looking up a phone number in a directory. The registry sees a query from Cloudflare's network; the domain owner is not notified and there is no trace of it in their account. You can check a supplier's or a competitor's domain as freely as your own.
Yes. Domain and DNS ownership is part of every managed IT engagement we run — the registrar account consolidated somewhere the business actually controls, locks on, auto-renew verified against a company card rather than someone's personal one, and expiry tracked so it is a calendar entry rather than an incident. It is the cheapest piece of resilience in IT and the one most often left to whoever built the first website.