TechAtelier
PRODUCTION

Domain name audit: the checklist before production

Check the domain layer by layer: DNS delegation, website, TLS certificate, email, security and monitoring.

A domain name audit verifies that the DNS directs each service to the right target, then that the web, HTTPS and messaging actually work. Before going live, check the configuration in a reproducible order and keep a rollback option.

When to audit a domain name?

Perform this check before opening a site, during a hosting or email migration and after a major change in the DNS zone. Repeat it regularly to spot an expiry, regression or forgotten service.

One change can be visible on one resolver and still absent on another. Reduce the TTL in advance when the cutover requires it and keep the old target until stabilized.

1. Check delegation and DNS zone

  • NS servers reported to the registrar correspond to authoritative servers;
  • A and AAAA records point to the right addresses;
  • CNAMEs do not create loops and correspond to the intended service;
  • the answers are consistent from several resolvers;
  • old records that became useless were identified before deletion.

If IPv4 and IPv6 are published, the service must respond correctly on both protocols. A forgotten AAAA address can send some of the visitors to an old infrastructure. To review the role of each entry, see the guide on DNS A, AAAA, CNAME, MX and TXT records.

2. Test the site and HTTPS certificate

Check the HTTP status, content actually displayed and redirects. A 200 response is not enough if it contains a generic error page or the wrong site.

  • the certificate covers the domain and subdomains used;
  • the certification chain is complete and the expiry date is correct;
  • the HTTP-to-HTTPS redirect leads to the expected canonical URL;
  • each public subdomain responds with the right service.

Please enable HSTS on a wide perimeter only after validation of all relevant subdomains. See also what TLS certificate actually protects.

3. Check domain email

Check MX records, SPF, DKIM and DMARC, then send a real message in both directions. The DNS alone does not confirm that the server signs the messages actually used.

  • MX records point to the active provider;
  • SPF allows all legitimate senders without multiplying unnecessary mechanisms;
  • DKIM signs messages with a published selector;
  • DMARC is aligned and its policy evolves gradually after analysis of the reports.

To understand the articulation of these mechanisms, see differences between SPF, DKIM and DMARC.

4. Review DNSSEC and CAA

DNSSEC protects the integrity of responses when the chain of trust is complete. CAA indicates which authorities can issue certificates for the domain.

An incorrect DNSSEC delegation can make the domain inaccessible to users of validating resolvers. Check the complete chain before final activation and after any change of DNS provider.

5. Check technical signals for engines

  • important URLs respond without redirect loop;
  • titles, descriptions and canonical tags correspond to the pages;
  • robots.txt does not block useful resources;
  • the sitemap contains only the canonical URLs to index;
  • private spaces remain protected and noindex.

Audit the domain in one request

DomainCheck passively inspects DNS, TLS, e-mail and technical SEO, then presents the corrections to be considered as a priority.

Audit my domain Create my Protect account

6. Monitor after production

The audit describes a state at a given moment. After switching, monitor availability, HTTP codes, certificate expiration, DNS changes and email authentication. Also define who receives the alerts and in what order they should be treated.

To implement this follow-up, see the guide to monitor a domain, its TLS certificate and DMARC, then the method for prioritize domain alerts.

Frequently Asked Questions

How to conduct a domain name audit?

Check the delegation and DNS records, then the site and its certificate, the email service, DNSSEC and CAA, SEO signals and finally monitoring.

When should a domain name be audited?

Before production or migration, after a significant DNS change and regularly to detect regressions.

What DNS records should be checked?

Check at least NS, A, AAAA, CNAME, MX and TXT records used by SPF and DMARC. Add CAA and DNSSEC validation chain when activated.

Is a DNS audit sufficient to validate a site?

No. Also test HTTP, HTTPS, certificate, messaging and other services from outside.

A useful audit always follows the same order

Start with the DNS delegation, validate each service, and then activate continuous monitoring. This method limits simultaneous changes and makes diagnosis easier when a check fails.

Published 19 July 2026 ยท Updated 20 August 2026.