40 diagnostic tools and generators. Free, no account required.

Run 100+ checks across DNS, mail, web, blacklists and email authentication and get a scored report.

List the mail servers (MX records) for a domain in priority order, resolve their IPs and check each against blacklists.

Retrieve and validate the DMARC policy of a domain: tags, syntax, alignment, reporting addresses.

Find and validate the SPF record, expand includes, count DNS lookups (10-lookup limit) and flag syntax issues.

Look up and validate a DKIM public key for a selector, including key length and flags.

Email deliverability audit: MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT and reverse DNS in one report.

Paste raw email headers to trace the delivery path, delays and SPF/DKIM/DMARC authentication results.

Validate the BIMI record, logo URL (SVG Tiny PS) and VMC certificate reference.

Fetch and validate the MTA-STS DNS record and the HTTPS policy file.

Check the SMTP TLS Reporting record and its reporting addresses.

Connect to a mail server: banner, EHLO, STARTTLS, reverse DNS, open relay and response times.

Validate an SPF record before you publish it.

Upload a DMARC aggregate (RUA) XML/GZ/ZIP report and read it as a human.

Audit the authoritative name servers of a domain: consistency, SOA, glue, open recursion and response times.

Resolve the IPv4 address (A record) of a host name.

Resolve the IPv6 address (AAAA record) of a host name.

Find the canonical name a host name is aliased to.

List the authoritative name servers of a domain and their IP addresses.

Retrieve all TXT records for a name — SPF, verification tokens, DKIM and more.

Show the Start of Authority record: primary NS, serial, refresh, retry, expire and TTL values.

Look up the reverse DNS host name of an IP address and check forward confirmation.

See which certificate authorities are allowed to issue certificates for a domain.

Look up service records (e.g. _sip._tls, _autodiscover._tcp).

Query 12 public resolvers around the world to see whether a DNS change has propagated.

Check whether a zone is signed (DNSKEY/DS) and validates with a validating resolver.

Check an IP address or domain against 60+ DNS-based blacklists (RBL/DNSBL) in real time.

Verify a URL responds over HTTP/HTTPS: status, redirects, response time, security headers.

Inspect the TLS certificate: validity, expiry, chain, SANs, issuer and protocol support.

ICMP ping a host and measure latency and packet loss.

Check whether a TCP port is open (host:port).

Trace the network path to a host.

Registration details, registrar, creation and expiry dates for a domain, or the owner of an IP block.

Find the autonomous system, network owner and country of an IP address.

Reverse DNS, ASN, geolocation hints and blacklist status for an IP.

Build a correct SPF record from your sending sources.

Generate a DMARC record with the right policy, reporting and alignment settings.

Generate a DKIM key pair (1024/2048-bit) and the DNS record to publish.

Create a BIMI record from your logo and VMC certificate URLs.

Generate the MTA-STS DNS record and policy file.

Generate a TLS-RPT record.