What is a DNS check?
A DNS check asks the Domain Name System for the records a domain publishes: addresses (A and AAAA), aliases (CNAME), mail servers (MX), nameservers (NS), text records (TXT), the zone’s start of authority (SOA) and certificate rules (CAA). Each record carries a TTL, the number of seconds resolvers may cache it before asking again.
Reading the result
Faults come first, then each record type with its records and TTLs, asked of Google Public DNS and Cloudflare at once. A type with no records says so; a name that does not exist is reported as NXDOMAIN, which differs from a type that is simply empty. The first four MX hosts are also looked up, to confirm each one has an address a sender can connect to.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common problems it finds
No MX record
RFC 5321 section 5.1 then has senders deliver to the domain’s own address (the implicit MX). If no mail server listens there, mail to the domain fails, and replies to anything it sent are lost.
A null MX beside other MX records
A null MX ("0 .") says the domain takes no mail, and RFC 7505 forbids publishing any other MX next to it. The two contradict each other, so senders cannot know which to believe.
A CNAME at the domain itself
The top of a zone must hold SOA and NS records, and a name with a CNAME may hold nothing else (RFC 2181 section 10.1). Use your provider’s ALIAS or flattening record instead.
An MX host with no address, or that is an alias
An MX must name a host with its own A or AAAA record, never a CNAME (RFC 2181 section 10.3). A host that does not resolve is one senders cannot reach.