Domain health, five signals.
DNS records (A · AAAA · MX · TXT), SSL status, domain age, Wayback first archive, PageSpeed score. One composite grade. Runs on Cloudflare DNS-over-HTTPS, Wayback Machine, RDAP, and Google PSI; no signup.
Five public-API signals on a single domain: Cloudflare DNS-over-HTTPS for A/AAAA/MX/TXT records, Wayback Machine for first-archive timestamp (domain age), RDAP for registration data, and Google PageSpeed Insights for the performance score. Five cards, one composite Health Grade. Typical run: 30-60 seconds.
Privacy: each signal queries only its named public API. Zero server state on Digital Heroes. Recent checks stay in browser localStorage.
What each card actually means.
DNS records tell you the domain resolves and where mail/services route. A and AAAA are IPv4 / IPv6 host records; MX is mail routing; TXT carries SPF, DKIM, DMARC, and verification strings for services like Google Workspace. A clean DNS configuration means SPF + DMARC are present (email deliverability), MX records resolve, and the apex (no `www.`) at minimum has an A record. We pull all five record types via Cloudflare's public DNS-over-HTTPS endpoint, which is the same RFC 8484 endpoint browsers use directly.
HTTPS reachability is the simplest signal: can a browser reach the domain over HTTPS without throwing a certificate error. We attempt a HEAD request from your browser to the apex over HTTPS; success means the certificate chain validates and the server is responsive. For a deeper SSL inspection (chain depth, protocol versions, cipher suites, key strength), the dedicated SSL Labs SSL Server Test is the canonical tool.
Domain age is sourced from RDAP first (the IETF's structured replacement for WHOIS). RDAP returns the registration date, expiration date, and registrar of record in JSON. When the TLD restricts RDAP access (some ccTLDs do), we fall back to the Wayback first-archive timestamp as a lower-bound age estimate. Domain age is not a strong ranking factor on its own, but it is part of the trust signal Google has confirmed it considers.
Wayback archive tells you whether the Internet Archive has captured the domain at all and when first. A domain with a 2008 first archive sits in a different trust band from a domain with no archive, even if both register today. The signal is asymmetric: an old archive is strong evidence of "been around"; the absence of an archive is not necessarily strong evidence of "fresh" because the Internet Archive samples the web rather than crawling exhaustively.
PageSpeed (PSI) is the same Google PageSpeed Insights signal used by our Lighthouse Score Checker — a single mobile-strategy run of the Performance category. It is the heaviest weight in the composite (35%) because for a working production domain, speed dominates user experience and ranking. Domains can pass DNS / SSL / age / archive while still being too slow to convert; the PSI signal catches that.
The composite Health Grade weights these five signals (15% / 20% / 15% / 15% / 35% as listed) and maps the total onto an A-F letter grade. The grade is heuristic — specific signals matter more than the aggregate for most use cases. Use the grade as a quick scan; use the breakdown bar to see which signals are leaving points on the table.
Three jobs this tool does.
Job 1: Backlink-source vetting. Before accepting a guest-post placement or sponsored link, run the source domain. A grade of A or B with a Wayback archive over 5 years and a PageSpeed score above 70 indicates a domain worth getting a link from. A grade of D or F with a fresh registration and no archive indicates a likely link-farm domain you should pass on.
Job 2: Acquisition due diligence. Buying a brand or agency? The target's primary domain should grade A or B. Anything below B means there's technical-debt cleanup baked into the acquisition cost: SSL chain repair, DNS hygiene, content speed-up. The breakdown bar quantifies the work.
Job 3: Self-audit before a big SEO push. Run your own domain before committing to a 6-month SEO program. If the domain grades C or below, the SEO investment will under-perform until the technical signals improve. Fix DNS / SSL / speed first; then push content + backlinks.
For deeper investigations on individual signals, our sibling tools cover them: Lighthouse Score Checker for full audit findings, Core Web Vitals Checker for field data, Website Audit for the full DH-branded scorecard. For SSL chain detail, SSL Labs; for full WHOIS / RDAP, ICANN Lookup directly.
Six questions users ask.
What does this tool check?
Five signals against a single domain: DNS records (A, AAAA, MX, TXT) via Cloudflare's public DNS-over-HTTPS endpoint; SSL/HTTPS status via the same DNS-over-HTTPS endpoint plus an HTTPS reach check; domain age via the Wayback Machine availability API (first archive date); registration data via RDAP (the IETF replacement for WHOIS); and a PageSpeed Insights performance score. Each signal becomes a card in the composite dashboard, plus a single Health Grade.
Which APIs does this use?
All public, free, CORS-enabled. Cloudflare DNS-over-HTTPS at cloudflare-dns.com/dns-query for the DNS records; archive.org/wayback/available for the first-archive lookup; rdap.org/domain/{domain} for registration metadata (an RDAP gateway aggregating registry responses); googleapis.com/pagespeedonline/v5 for the Lighthouse score. No keys required for any of them at the volumes our users hit.
Why is the domain age signal useful?
Domain age is a soft signal Google has confirmed it considers (alongside many others) for trust. A domain first archived in 2008 sits in a different trust band than a domain first archived three weeks ago. Combined with consistent registration history (no recent expiry-rebirth cycle) and an SSL certificate that is properly chained, age tells you the domain has 'been around' rather than being a fresh shell. Useful when evaluating a backlink source or a brand acquisition target.
What does 'composite Health Grade' mean?
We weight the five signals into a single grade A through F: DNS configured (15%), HTTPS reachable + chain valid (20%), domain age over 2 years (15%), Wayback first archive present (15%), PSI Performance score (35%). The weighting reflects what actually matters for a working production domain: speed and SSL beat age. The grade is heuristic; specific signals matter more than the aggregate for most use cases.
Does this tool store the domain I check?
No. Each query goes only to the public API listed for that signal. Nothing is logged on Digital Heroes servers. Recent checks live in your browser's localStorage. No signup, no email collection, no analytics beacon that includes your domain.
Why does my domain show 'No archive yet'?
The Wayback Machine archives a sample of the open web rather than every URL. A domain registered last week may not have been crawled yet by the Internet Archive. Submit it to web.archive.org/save manually if you need the first archive on the record. For a brand-new domain, the absence of a Wayback archive is itself a signal — it indicates the domain is genuinely fresh rather than aged.
Grade C or below? Two-week fix.
A 30-minute call covers which signals to fix in what order, the engineering required, and a fixed-price quote. Most fixable causes are in PageSpeed and DNS hygiene.