Crowswatch

Documentation

DNS issue reference

When a domain health scan flags something, this page explains what the finding means, why it matters, and how to fix it. Severities follow the scan: critical issues break something now, warnings are risks to address soon, and advisories are improvements.

At a glance

FindingSeverityIn short
No A recordCriticalYour domain has no address record, so it won’t load
DNS lookup failedCriticalThe domain couldn’t be resolved at all
SSL certificate expiredCriticalBrowsers will block the site with a security warning
SPF record missingWarningReceivers can’t verify who may send email as you
No DMARC policyWarning / CriticalNo instruction on what to do with spoofed mail

No A record

An A record maps your domain to an IPv4 address so browsers know which server to reach. Without one (and no equivalent AAAA/CNAME), the domain resolves to nothing and the site won't load.

How to fix it

  1. In your DNS provider, add an A record for the host (@ for the root, or a subdomain) pointing at your server's IPv4 address.
  2. If your host gives you a hostname rather than an IP, use a CNAME instead (but not on the root domain — see below).
  3. Allow for DNS propagation, then re-scan.
A record vs CNAME: use an A record at the root domain (example.com); a CNAME is only valid on subdomains like www.

DNS lookup failed

Crowswatch couldn't resolve the domain at all — no nameservers responded, or they returned nothing. This is more fundamental than a missing record: the domain's DNS itself isn't answering.

How to fix it

  1. Confirm the domain is registered and not expired at your registrar.
  2. Check the NS records point at nameservers that are actually live.
  3. If you just changed nameservers or registered the domain, give it time — this can be temporary during propagation.
A one-off lookup failure can be transient. A persistent one usually means expired registration, misconfigured nameservers, or a suspended domain.

SSL certificate expired

An SSL/TLS certificate is what makes the padlock and https:// work. When it expires, browsers show a full-page security warning and block access until it's renewed.

How to fix it

  1. Renew or reissue the certificate with your provider or host.
  2. If you use Let's Encrypt or similar, check that auto-renewal is running — most expiries are a broken renewal cron, not a forgotten renewal.
  3. Make sure the new certificate is installed on every server/load balancer behind the domain.
Crowswatch warns before expiry — under 30 days is a warning, under 14 is critical. Set up an SSL expiry alert so you never reach zero.

SPF record missing

SPF (Sender Policy Framework) is a TXT record listing which servers are allowed to send email for your domain. Without it, receiving mail servers have no way to confirm your mail is legitimate, so it's easier to spoof and more likely to land in spam.

How to fix it

  1. Add a single TXT record at the root beginning v=spf1.
  2. Include every service that sends mail as you (for example include:_spf.google.com), then end with ~all (soft-fail) or -all (hard-fail).
  3. Keep it to one SPF record — multiple SPF records is itself an error.
Avoid +all, which authorises anyone to send as you — Crowswatch flags that as critical.

No DMARC policy

DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails those checks — and where to send reports. Without a DMARC record, spoofed email using your domain is more likely to be delivered.

How to fix it

  1. Add a TXT record at _dmarc.yourdomain.com beginning v=DMARC1.
  2. Start in monitor mode with p=none and a rua= reporting address to see what's sending as you.
  3. Once your legitimate senders pass SPF/DKIM, tighten to p=quarantine and then p=reject.
Crowswatch treats p=reject/p=quarantine as healthy, p=none as a warning (monitor-only), and a missing record as critical.

Next steps

Domain healthRun scans and read the scoreAlertsGet warned before things expire