# get_dns_diagnostics

> Roll up DNS health for one owned domain in a single call: it composes the authoritative zone read (what your zone says), the public-resolver lookup (what the internet…

- Tier: R
- Required scope: read:dns
- Annotations: readOnlyHint, idempotentHint, openWorldHint
- Docs: https://api.inleed.com/tools/get-dns-diagnostics

## Description

Roll up DNS health for one owned domain in a single call: it composes the authoritative zone read (what your zone says), the public-resolver lookup (what the internet actually returns) and the registrar DNSSEC read, and returns `{verdict, summary, findings[], signals:{zone, public, dnssec}, notes}` — a ranked `findings[]` (each `{severity, title, evidence, recommendation}`) that names the mismatches: root A not pointing here, NS the registry publishes differing from the zone, a domain that does not resolve publicly, missing MX. `verdict` is the most severe finding (`critical|warning|info|ok`). This is the DNS side only: for the website use `get_website_diagnostics`, for mail use `get_email_diagnostics`; for one raw record set use `list_dns_records`. It changes nothing.

## Input schema

- `input` — string (required). A domain, email address, website URL, numeric service id, or hosting-account username the customer actually owns. Resolved to the owning account automatically; the resolved target is echoed back in the response.

## Example call

```json
{
  "name": "get_dns_diagnostics",
  "arguments": {
    "input": "example.se"
  }
}
```