Full Site Health Check
One domain in — everything checked: website, SSL, SPF, DKIM, DMARC, mail routing and blacklists, scored out of 100 in plain English.
Why one combined check beats seven separate ones
Email and website failures rarely respect tool boundaries. The site is "up" but its certificate expired, so the checkout is effectively down. SPF passes, but the sending IP is blacklisted, so the mail lands in spam anyway. DMARC exists, but at p=none, so the spoofing continues under a false sense of security. Checking each piece in isolation tells you each piece works; checking them together tells you whether the domain works — which is the only question your customers and their inboxes actually ask.
The score is deliberately simple and conservative: 20 points for a reachable website, 15 for a healthy certificate, 20 for a valid SPF record inside its lookup budget, 15 for a discoverable DKIM key, 20 for DMARC strength from monitoring-only up to reject, and 10 for a clean blacklist sweep. A domain doing everything right scores in the 90s. Most real domains, the first time they run this, land between 35 and 65 — not because their owners are careless, but because nobody ever assembled the full picture in one place.
What to fix first
Work from red to amber, and within that, in this order: a down website and an expired certificate are emergencies; a blacklisted mail IP is next, because mail is failing now; then SPF validity, then getting DKIM signing everywhere, then walking DMARC up to reject using the generator and the report data. Each individual checker linked from the report explains its fix in detail.
And then the uncomfortable truth this page cannot help with: this is a snapshot. DNS records get edited, certificates tick down, IPs get listed at 3 a.m. The domains that stay healthy are the ones being watched continuously — that is the job UptimeVitals was built for, and this free check is its front door.
Full Site Health Check — frequently asked questions
Is the check safe to run on any domain?
Yes. Everything here reads public information — DNS records, the public certificate, blacklist databases — and makes one ordinary HTTP request to the site, exactly like a visitor. Nothing intrusive is probed or scanned.
Why did DKIM not show up when I know we sign mail?
DKIM keys live under selectors chosen by each sending service. We probe the seven most common; a service with a custom selector will not be found automatically. The standalone DKIM Checker accepts any selector.
How is the score calculated?
Transparently, as described above — website 20, SSL 15, SPF 20, DKIM 15, DMARC 20, blacklists 10. No hidden weighting, and the per-section findings matter more than the number.
How often should a domain run this?
After any DNS, hosting or mail-provider change at minimum — and continuously if the domain runs a business, which is the difference between this free snapshot and monitoring.