Migrations don't fail on the big stuff. They fail on SPF counts and expiring certs.

Disclosure up front: I built the tool in this post. It's free, there are no accounts, and the checklist below works fine with nothing but a terminal — the tool just saves you from running it by hand for the hundredth time.

Every migration I've ever done — mail moves, host moves, DNS provider changes — the plan was fine. The servers were fine. What bit me, every time, was something small and stupid that nobody had looked at since the domain was set up:

• An SPF record quietly using 11 of its 10 allowed DNS lookups, because somebody added one more include: two years ago.
• A certificate with 9 days left on it, discovered during the cutover.
• DMARC still sitting at p=none — "monitoring" — since 2021.
• A mail server with no PTR record, so half the migrated mail lands in spam.

None of those are hard to check. They're just tedious to check together, so they get checked one at a time, usually after something breaks.

The manual version (steal this)

Here's the routine I used to run by hand before touching anything. It's the whole article in nine lines:

dig A +short example.com                 # does it resolve at all?
dig MX +short example.com                # where does mail go?
dig TXT +short example.com               # SPF (count the lookups!)
dig TXT +short _dmarc.example.com        # DMARC — and is it past p=none?
dig TXT +short google._domainkey.example.com   # DKIM (selector varies)
# PTR on each mail server's IP:
dig -x 203.0.113.10
# cert expiry:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
curl -sI https://example.com | grep -iE 'strict-transport|x-content-type|x-frame|content-security'

If you do that faithfully for every domain, you don't need my tool. I just got tired of doing it faithfully.

What I built instead

Domain Health on IPeeve runs those checks as a bundle and gives you one page back:

• DNS resolves — public A/AAAA present
• Mail routing (MX) — including the null-MX case, where "no mail" is the correct answer
• Mail server reverse DNS — PTR present on the MX hosts
• SPF — with the actual lookup count against the limit of 10, and a hard fail on +all
• DKIM — checks the common selectors, and you can supply a non-standard one
• DMARC — and whether the policy actually does anything
• SSL certificate — issuer and days left; under 15 days is a warning, not a surprise for later
• HTTP security headers — HSTS, X-Content-Type-Options, X-Frame-Options, CSP

Every check gets a plain pass / warn / fail with a one-line finding. Anything that doesn't pass also gets a short "why it matters and how to fix it" note — because a red mark without the fix is just anxiety with extra steps.

Two things turned out to matter more than I expected:

The report has a permanent address. Every result lives at ipeeve.com/health/your-domain — here's a live one: ipeeve.com/health/example.com. I paste that into tickets and chats constantly. Half of troubleshooting is getting everyone to look at the same facts, and a link beats a screenshot of a terminal every time. There's also a copy button that gives you the whole report as plain text or Markdown, fixes included, if you'd rather drop it straight into the ticket.

It deliberately does less than it could. The tool reads public DNS records and a certificate — the same things any browser or mail server checks. It does not scan ports, probe servers, or send mail. Results are cached for 15 minutes, which is fresh enough to troubleshoot with and polite enough to the servers being queried, and checks are rate-limited. A public tool that hammers other people's infrastructure is a dick move, and I didn't want to build one.

Honest limits

• DKIM is checked against the selectors people actually use (default, google, s1, s2, mail) plus one you type in. If your provider uses something exotic and you don't tell it, it'll report "not found" — that's a miss in the tool, not necessarily in your domain.
• It checks the domain you give it, not every subdomain you own.
• A row of green passes means the public records are sane. It does not mean your migration will go well. It means the boring stuff won't be the reason it doesn't.

Try it, then tell me what's missing

Run it against your own domain before your next migration, renewal, or "why is our mail in spam" fire: ipeeve.com/health.

If there's a check you'd want in the bundle — something that's bitten you on a cutover — I genuinely want to hear it in the comments. The trench-coat full of small problems is always hiding one more.