Frequently Asked Questions
SSL, DNS, and email authentication explained simply.
What is an SSL certificate, and why does its expiry matter?
An SSL/TLS certificate encrypts traffic between a visitor's browser and a website, and proves the site is who it claims to be. Certificates have an expiry date — usually 90 days to a year, depending on the issuer. Once expired, browsers show visitors a security warning and most will leave immediately. Checking expiry ahead of time avoids unplanned downtime or lost trust.
What's the difference between A, CNAME, MX, TXT, and NS records?
A records point a domain to an IPv4 address. CNAME records alias one domain name to another. MX records tell the internet which mail servers handle email for a domain. TXT records hold arbitrary text, commonly used for domain verification and email authentication (SPF, DMARC, DKIM). NS records specify which nameservers are authoritative for a domain's DNS.
What is SPF and why do I need it?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email on behalf of your domain. Without it, it's easier for someone to spoof your domain in phishing emails, and your legitimate emails are more likely to land in spam.
What is DMARC?
DMARC builds on SPF and DKIM by telling receiving mail servers what to do when a message fails authentication (reject it, quarantine it, or let it through) and optionally sends you reports about who's sending mail using your domain. It's published as a TXT record at _dmarc.yourdomain.com.
What is DKIM, and what's a "selector"?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email, letting receiving servers verify it wasn't altered in transit and genuinely came from your domain. The signature's public key is published as a TXT record at selector._domainkey.yourdomain.com — the "selector" is just a label your email provider chooses (e.g. google, default, k1) to identify which key to use, since a domain can have multiple DKIM keys over time.
Why does a DNS check sometimes show different results elsewhere?
DNS changes don't apply instantly everywhere — they propagate gradually as resolvers around the world refresh their cached records, which can take anywhere from a few minutes to 48 hours. The result you see here reflects what our server's resolver currently sees, which may briefly differ from what your own ISP or another checker shows during propagation.
Is this tool free, and do I need to sign up?
Yes — both the SSL checker and DNS checker are completely free, with no account or email required. There's a light rate limit per IP address to keep the service fair and prevent abuse.