Free tools · no signup
DNS & email tools
Deterministic diagnostics — the same engine the scanner uses, never an AI guess. For the full seven-check picture of a domain, run a scan from the home page.
Paste a record or a domain — count DNS lookups against the 10-lookup limit (nested includes counted recursively) and see exactly which mechanism goes over.
Paste a DMARC record — every tag validated with plain-English findings, plus a deterministic, safely-capped upgrade preview of the next policy step.
Check any DKIM selector, not just the common ones a free scan can guess — see the raw published record, key strength, and revocation status.
No DMARC record yet? Pick a policy, report address, and alignment mode — get a ready-to-publish record, RFC-validated in code, never an AI guess.
Watch a receiving mail server evaluate your domain, step by step: every include: it follows, the running count against the 10-lookup SPF limit, the DMARC record tag by tag, the alignment gate, and the record that fixes what it found.
Already collecting DMARC aggregate reports? Upload one XML, .gz, or .zip to read it as a table — every sending source, its volume, and SPF/DKIM alignment. Parsed on our servers, never stored.
Just edited a record? Read it straight from the domain's own nameservers, cache-free, beside two public caching resolvers — so you can tell an edit that is live from one caches still hide, and see how long those caches have left.
Already know the edit is live on your own nameservers, but someone across the world still sees the old value? Read the same name from six vantage points on separate continents at once and see exactly which ones have caught up.
Look up a mail server IP's reverse name — and check it resolves back to the same address, which is the test receivers actually apply. A name on its own confirms nothing.