SPF Record Checker

Send HTTP requests with custom method, headers, body, and authentication — inspect the full response.

Load a URL in headless Chromium and stream every fetched resource with size and timing.

The simplest possible check: fetch the page, confirm it returns 2xx.

Test any URL for CORS (Cross-Origin Resource Sharing) with a custom method, headers, and body — see exactly why a browser would allow or block the request.

Crawl a website and find broken internal links — renders JS pages with a headless browser.

Check an IPv4 address against 49 major DNS blacklists (Spamhaus, SORBS, Barracuda, SpamCop, etc.).

Continuous traceroute with per-hop loss and RTT statistics.

Trace the path packets take to a destination host, hop by hop.

Ping many hosts in parallel and report which are alive.

Send ICMP echo requests and report RTT and packet loss.

Resolve a domain or IP to its city, country, ASN/org, and coordinates — with a map.

Convert IPv4 to/from IPv4-mapped IPv6 (::ffff:a.b.c.d).

Look up a MAC address's first 3 octets in the IEEE OUI vendor database (curated subset).

One-click domain scorecard — Blacklist, Mail Server, Web Server, and DNS checks graded Errors / Warnings / Passed, MXToolbox-style.

Consolidated MX, SPF, DMARC, and DKIM-selector lookup for an email domain.

Resolve a domain's MX hosts to IPs and check each against 49 IP blacklists plus the domain itself against 9 domain blacklists.

Connect to an SMTP server, capture its banner + EHLO capabilities, and test STARTTLS.

Check TCP port reachability; optionally send a payload and read the reply.

Inspect a server's TLS handshake: version, cipher, ALPN, full cert chain.

Probe a list of hostnames (max 16) for HTTP and HTTPS availability.

Send N HTTP HEAD requests to a URL and report min/median/mean/max/stddev latency. From this server's vantage.

Discover the path MTU to a host by sending increasingly large DF-bit pings (binary search).

Break a CIDR into network, broadcast, mask, wildcard, and usable host range.

Verbose subnet calculator with address classification flags.

Look up the announcing ASN, covering prefix, country, and AS neighbours for a public IP via RIPEstat.

Generate router prefix-list and AS-path filters from IRR data.

Probe which TLS protocol versions a server accepts and show the cipher each negotiates.

Full chain validation, OCSP stapling, SCT count, and per-TLS-version cipher matrix.

Days remaining before a server's TLS certificate (and its full chain) expires.

Search Certificate Transparency logs for every SSL certificate ever issued to a domain — reveals subdomains, issuers, and historical issuance.

Query a public NTP server: stratum, offset, round-trip, ref-id, root delay/dispersion. Does not change the system clock.

Fetch a server's SSH version banner and host public keys (Ed25519, ECDSA, RSA) with fingerprints. No authentication.

Negotiate HTTP/2 via ALPN and decode the server's SETTINGS frame (window size, max streams, etc.).

Send a WebSocket Upgrade handshake and verify the Sec-WebSocket-Accept response, subprotocols, and extensions.

Benchmark HTTP/2 server performance — measure requests per second, latency distribution, and concurrent stream throughput under sustained load.

Convert UTF-8 text to a hex string, or parse a hex string back to text (separators :/.- ignored).

Convert UTF-8 text to 8-bit binary, or parse a binary string back to text.

Convert text between common casings: UPPER, lower, Title, snake_case, kebab-case, camelCase.

Convert a number between decimal, binary, octal, and hexadecimal representations.

Convert between Unix epoch seconds and ISO/RFC datetime formats (UTC).

Convert between dotted IPv4 notation, 32-bit decimal, hex, and dotted binary.

Decode a JWT into its header and payload (no signature verification — that needs the signing key).

Compute the cryptographic hash of UTF-8 text using MD5, SHA-1, SHA-256, SHA-384, or SHA-512.

Compute an HMAC of a message using a shared key and a chosen hash algorithm.

Days remaining before a domain's registration expires.

Days remaining before a domain's DNSSEC signatures (RRSIGs) expire.