Check Domain and VPS Health with dnsxray.com for Free

June 2026 · 6 min read

Every time you migrate a domain to a new VPS, set up an email server, or install an SSL certificate, the real work is verification — making sure everything actually works, not just assuming it should. Most online tools only check 1 or 2 things, but dnsxray.com combines everything a VPS admin needs in one place — DNS, SSL, email authentication, security headers, and uptime checking — all free, no signup required, ready to use immediately.

Tools Available in dnsxray.com

At the time of writing, dnsxray.com covers 4 major categories:

What I appreciate most is the lack of ads and the real-time results — no waiting for page refreshes.

Workflow: What to Check First When Migrating to a New VPS

After migrating your site to a new VPS and updating DNS, here's the verification order that works in practice:

Step 1: Check DNS Propagation

Go to dnsxray.com/dns, enter your domain, select record type A. You'll see what IP each nameserver is returning — if some still point to your old IP, propagation isn't complete yet. Wait until all resolvers return the new IP consistently.

# Check DNS propagation from the command line
dig @8.8.8.8 example.com A +short   # Google DNS
dig @1.1.1.1 example.com A +short   # Cloudflare DNS
dig @9.9.9.9 example.com A +short   # Quad9 DNS

Step 2: Verify SSL Certificate

At dnsxray.com/ssl, you'll see the grade (A+/A/B/C), expiration date, whether the certificate chain is complete, and OCSP status. It will also flag weak ciphers. If you get a B grade or lower, check whether TLS 1.0 or 1.1 is still enabled.

Step 3: Check Email Authentication

For VPS running a mail server, use dnsxray.com/mailtest to verify SPF/DKIM/DMARC all at once. This page will immediately show which records are missing or misconfigured, with suggestions to fix them.

Step 4: Verify Security Headers

At dnsxray.com/security-headers, check whether your Nginx or Apache is sending all the required headers — HSTS, X-Frame-Options, Content-Security-Policy, X-Content-Type-Options, Permissions-Policy. Missing headers come with configuration suggestions.

# Check security headers with curl
curl -sI https://example.com | grep -E "Strict|X-Frame|Content-Security|X-Content|Permissions"

Step 5: Verify Redirect Chain

Use dnsxray.com/redirect to ensure your http → https redirect is correct, www → non-www (or vice versa) redirect is complete, and there are no redirect loops or chains longer than 3 hops.

Most Useful Features for VPS Admins

Fresh Check — Query Authoritative NS Directly

The problem with typical DNS tools is that results may come from the tool's own cache. dnsxray.com has a "Fresh Check" button that queries the authoritative nameserver directly, bypassing all caches — use this to verify that a TXT record you just added has actually propagated, not just showing old cached data.

GeoIP with ASN

At dnsxray.com/geoip, you can check an IP for country, region, city, ISP, and ASN — useful to verify that your newly leased VPS has correct GeoIP mapping. Some datacenter IPs get mapped to the wrong country, which can break geo-blocking rules.

Technology Detection

See what web server, CMS, and framework your site is using — useful to verify that server signatures you want hidden are actually hidden after configuring server_tokens off in Nginx.

Verify Your Domain and VPS Are Production-Ready

Checklist that should all pass before go-live:

# 1. DNS A record points to the correct IP
dig example.com A +short
# Must return the IP of your new VPS

# 2. SSL certificate is working
curl -sI https://example.com | head -1
# Must return HTTP/2 200 (not 301 or connection error)

# 3. HSTS header is correct
curl -sI https://example.com | grep -i "strict-transport"
# Should show max-age=31536000; includeSubDomains

# 4. HTTP → HTTPS redirect works
curl -sI http://example.com | grep -i "location"
# Must return Location: https://example.com/

# 5. Email: SPF record exists
dig example.com TXT | grep "v=spf1"

Common Issues & Troubleshooting

Error: "DNSSEC validation failed"

dnsxray.com reports that the DNSSEC signature is invalid — usually caused by DS records at your registrar not matching the DNSKEY at your nameserver. This often happens after changing nameservers without updating the DS record first:

# Check DS record at registrar
dig example.com DS +short

# Check DNSKEY at authoritative NS
dig @ns1.example.com example.com DNSKEY +short

# If they don't match, go to your registrar and update the DS record to match the new DNSKEY

Error: "SPF record has too many DNS lookups"

SPF has a limit of 10 DNS lookups — if you exceed this, it fails. The check at dnsxray.com shows you how many lookups each mechanism uses:

# View the complete SPF record
dig example.com TXT | grep "v=spf1"

# Fix: Use an SPF flattening tool to convert include: directives to direct IP ranges
# Or remove unnecessary includes, such as from email services you no longer use

Error: "SSL certificate chain incomplete"

Occurs on some mobile browsers that don't have the intermediate certificate in their trust store, even though desktop browsers don't have this issue:

# Check the certificate chain
openssl s_client -connect example.com:443 -showcerts 2>/dev/null | grep "s:/"
# Should show 3 lines: domain cert → intermediate → root

# If incomplete: Use fullchain.pem instead of cert.pem in your Nginx config
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

Error: "Security headers score: D — missing CSP"

Content-Security-Policy is the hardest header to configure because the whitelist must cover every resource you use. Start with report-only mode:

# In Nginx: Start with report-only mode to collect violation logs
add_header Content-Security-Policy-Report-Only "default-src 'self'; report-uri /csp-report";

# Check logs to see which resources are blocked, then migrate to the real CSP
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline';";

Error: "Redirect chain too long (5+ hops)"

Caused by multiple redirect layers: http → www → https → non-www. Ideally, keep it to just 1 hop:

# Check the redirect chain with curl
curl -sL -o /dev/null -w "%{url_effective}\n%{redirect_url}\n" \
  -D - http://example.com 2>&1 | grep -E "HTTP|Location"

# Fix: In Nginx, combine redirects into a single rule
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;  # Only 1 hop
}

Frequently Asked Questions

Is dnsxray.com free forever?

Yes, all tools are free and require no account signup. There are no rate limits for normal usage. It's maintained by the asiagb.com team, a Thai hosting provider, and is open to the developer and sysadmin community as a public tool.

How does it differ from MXToolbox or DNSChecker?

MXToolbox focuses on email and DNS with a premium monitoring plan. dnsxray.com covers more ground in web security (security headers, technology detection, redirect chains) and includes live GeoIP and DNSSEC verification. The advantages are a faster interface, no ads, and the Fresh Check feature that bypasses caching.

Can I use dnsxray.com to monitor uptime instead of other tools?

You can check on demand anytime, but there's no automatic alerting system. For continuous uptime monitoring with notifications when your site goes down, use a dedicated tool like Uptime Kuma or Grafana on your own VPS. However, dnsxray.com is excellent for on-demand checks after deployment or DNS changes.

Summary

I recommend dnsxray.com because it solves real problems admins face every day. Instead of opening 5 tabs for DNS, SSL, email, headers, and redirects separately, you open one tool and check everything at once. You save a lot of time, especially during go-live or troubleshooting, when every minute counts.