Free CAA record checker / CAA tester (CAA monitoring)
CAA record check / CAA tester: list apex issue/issuewild rows and see whether they still permit the live TLS issuer. Same DNS + handshake CrowWake watches hourly — paste-ready CAA rows when the allow-list drifts.
Full check / domain monitoring
Domain monitoring pulse — SPF + DKIM + DMARC + MX + SSL + CAA vs live issuer (email auth flock)
SPF checker
Free SPF checker — include tree + 10 DNS-lookup limit, missing/+all warn
DKIM / monitoring
DKIM monitoring — common selectors, missing/empty public key warn
DMARC / monitoring
DMARC monitoring — _dmarc policy present, p=none warn, spoofing posture
MX / monitoring
MX monitoring — inbound exchangers present, priorities + hosts
DNS A / monitoring
DNS monitoring: does the hostname still have an IPv4 A record
Apex / monitoring
Apex monitoring — A/AAAA at the bare domain + CNAME-at-apex warning
CAA record / tester
CAA record checker / CAA tester — allow-list present + does it permit the live TLS issuer
MTA-STS / monitoring
MTA-STS monitoring — DNS id + HTTPS policy (mode, mx, max_age) still live
TLS-RPT / TLS reporting
TLS-RPT checker / TLS reporting — _smtp._tls v=TLSRPTv1 rua still published
BIMI / monitoring
BIMI monitoring — default._bimi inbox brand-mark DNS still published
SSL / expired / monitoring
SSL days left or expired + live issuer (pair with CAA)
Website / uptime / HTTP status
HTTP status / uptime pulse — HTTPS status + title
Expiry / WHOIS monitoring
Domain expiry monitoring — registration runway via public RDAP/WHOIS path
Security headers / monitoring
Security headers monitoring — nosniff, HSTS, X-Frame-Options, HTTPS redirect still live
Open port scanner
Risky TCP ports — FTP, Telnet, MySQL, Postgres, Redis, MongoDB
TTFB / performance monitoring
Website performance monitoring — TTFB-style HTTPS first-byte pulse still sane
Fail or warn? You’ll get copy-paste DNS examples for this domain. After you start free monitoring, the same fix hints stay on the domain detail page.