Instruments for the wire.
A workshop of precision tools for DNS, mail authentication, and TLS. Point it at any domain for a full DNS audit: every apex record, nameserver and SOA health, DNSSEC, email records, subdomain discovery and takeover risks. It runs in your browser against public DNS, RDAP and Certificate Transparency. Nothing is stored and nothing is changed.
Modules
05 online
DNS Inspector
Any record type, two resolvers, DNSSEC status and TTLs in one view.
OpenMail Auth Lab
SPF lookup tree, DKIM key hunt, and DMARC decoded and scored against a hard standard.
OpenCert Watch
Certificate Transparency radar: every issued cert, expiry countdowns, and hostnames discovered.
OpenSubnet Forge
IPv4 and IPv6 CIDR math, masks, ranges and subnet splitting, all instant.
OpenThreat Intel
VirusTotal and urlquery verdicts for any domain, URL, IP or file hash, plus live URL scans.
Query the wire.
Resolve any record over DNS-over-HTTPS. Choose ALL to sweep the common types at once. DNSSEC validation comes from the resolver's AD flag.
Prove who sends.
SPF, DKIM and DMARC rated against a strict standard: SPF ends in -all within 10 lookups, DKIM is published, and DMARC enforces at p=quarantine or stronger at 100%. MTA-STS, TLS-RPT and BIMI are reported too.
Every cert, on record.
Certificate Transparency logs record every publicly trusted certificate issued for a domain and its subdomains. This lists them with expiry countdowns and finds the hostnames they cover. It shows what was issued, which may not be what a server is serving right now.
Bend the address space.
Type an IPv4 or IPv6 CIDR, like 10.20.0.0/22 or 2001:db8::/48, or an IPv4 address with a mask, like 192.168.1.10 255.255.255.0. Results update as you type.
Ask the sensors.
Paste a domain, URL, IP address or file hash. You get VirusTotal's multi-engine verdict and urlquery's reputation and recent sandbox scans. Use Scan live to send a URL for a fresh analysis. Lookups go through this site's API, which is rate-limited per visitor and caches results for an hour.