DNS

Check whether an ACME DNS-01 challenge is ready, with TXT matching, delegation-route checks, resolver comparison, and retry timing.

Check ACME HTTP-01 retry readiness by testing the host, token body, redirects, IPv6, cache, CDN or WAF, and backend sync evidence.

Check DNS, CNAME, HTTP, and HTTPS DCV proofs before a certificate retry, with CSR-hash handling, resolver evidence, and mismatch notes.

Generate a BIMI DNS TXT record with logo and evidence URLs, DMARC readiness checks, provider paste steps, charts, and exports.

Validate a domain's BIMI record with DMARC, SVG logo, resolver, and PEM evidence checks, then review readiness scores and fix notes.

Check a hostname's CAA policy with CNAME and parent-DNS lookup evidence, wildcard rules, issuer findings, and resolver comparison notes.

Validate DANE TLSA records for mail or TLS services with owner-name routing, DNSSEC AD checks, digest comparison, and readiness scoring.

Generate a DKIM DNS TXT record from a selector, domain, and public key with key-strength checks, split-string guidance, and DNS publish fields.

Validate a DKIM selector in public DNS, inspect the TXT key record, key strength, testing flags, and resolver evidence before troubleshooting mail authentication.

Build a DMARC TXT record with owner labels, policy tags, report URIs, external authorization notes, rollout warnings, and DNS split guidance.

Validate a domain's DMARC record in public DNS, review policy alignment, report destinations, rollout signals, and control scores before enforcement changes.

Estimate DNS resolver cache memory from QPS, hit rate, distinct inserts, TTL, DNSSEC overhead, headroom, and upstream-load charts.

Audit a domain's public DNS records, compare resolver snapshots, and spot missing authority, mail, address, policy, TTL, or timing risks.

Trace a hostname through delegation, aliases, DNSSEC clues, resolver drift, and negative-cache timing before chasing web, mail, or certificate failures.

Build a DNS denial proof for NXDOMAIN or NODATA, separating resolver evidence, NSEC/NSEC3 checks, CD-bypass splits, and retry timing.

Audit DNS glue and delegation for a domain, compare public resolver views, and turn NS address, CNAME, or DS gaps into repair evidence.

Check DNS propagation across public resolvers, compare expected answers, and review TTL, DNSSEC, ECS, latency, and holdout clues.

Enumerate public DNS records for a domain, URL, email domain, or IP with resolver evidence, mail-auth checks, DNSSEC clues, and action flags.

Look up DNS records for a domain, host, or IP with Google or Cloudflare DoH, TTL charts, DNSSEC flags, raw responses, and JSON exports.

Plan a DNS TTL cutover window with drain timing, negative-cache checks, resolver-load warnings, and exportable runbook evidence.

Check DNS wildcard behavior with random public resolver probes, closest-encloser clues, branch boundaries, and cache-aware result tables.

Draft DNS zone files from SOA, nameserver, mail, DNSSEC, and host records with TTL checks, ledger rows, and lint-ready exports.

Validate a DNS zone file before import, catching SOA/NS gaps, TTL risks, CNAME conflicts, mail-policy warnings, and normalized records.

Validate a domain's DNSSEC chain with DNSKEY, DS, RRSIG, resolver AD comparison, signature timing checks, and a pass-rate report.

Craft a DNS-over-HTTPS query packet, compare GET or POST replay data, inspect EDNS/DNSSEC flags, and decode live resolver replies.

Check whether a DNS name changes under EDNS Client Subnet hints with no-hint controls, echoed scope, resolver signals, and exports.

Inspect a domain's EDNS OPT response across public DoH resolvers with DNSSEC, NSID, ECS, padding, packet sections, and replay evidence.

Check raw email headers in your browser for relay delays, SPF/DKIM/DMARC alignment, ARC context, sender mismatches, and spoof-risk clues.

Audit hostname inventories for DNS-safe labels, naming regex drift, lowercase rules, required suffixes, duplicates, and JSON-ready cleanup notes.

Check a public IP, domain, or URL for approximate location, ASN, timezone, reverse DNS, map context, and follow-up network checks.

Check an email domain's MTA-STS TXT record, HTTPS policy, MX coverage, cache window, and policy-host certificate before enforce mode.

Look up a domain's MX records, compare public resolver answers, and flag Null MX conflicts, unresolved hosts, CNAME targets, and mail-policy clues.

Check a domain's nameserver health with resolver comparison, glue readiness, public-address checks, SOA timers, and repair cues.

Convert Unicode domains and xn-- Punycode labels in your browser, with DNS length checks, script warnings, and copy-ready forms.

Compare DNS-over-HTTPS resolver answers across open, security, and family profiles to spot policy splits, zero-sinks, and DNSSEC drift.

Check reverse DNS for an IP or hostname, verify forward-confirmed PTR names, compare public resolver views, and flag stale or weak records.

Generate reverse DNS zone text for an IPv4 CIDR block with PTR rows, SOA checks, RFC2317 parent records, and review-ready JSON.

Look up SMIMEA or OPENPGPKEY DNS records for a mailbox, derive the owner name, and compare DNSSEC, resolver, and payload evidence.

Build an SPF TXT record from real sender paths, provider includes, IP ranges, A/MX options, redirects, and lookup-budget warnings.

Check a domain's SPF record, trace include and redirect lookup cost, and spot duplicate records, weak endings, or over-limit policies.

Trace SIP, SIPS, XMPP, or LDAP service discovery with public resolver comparison, fallback notes, and terminal host address checks.

Validate a TLS-RPT record, review rua report destinations and related mail-policy signals, and build a DNS TXT snippet for publishing.

Trace a hostname's public CNAME path across resolvers, verify the final A, AAAA, MX, TXT, or CAA answer, and catch cutover drift.

Check a suspicious URL against Safe Browsing, SURBL, and local URL-shape signals, then review scoped verdicts, coverage gaps, and follow-up links.

Check domain registration records with RDAP-first lookup, WHOIS fallback, expiry timing, status clues, nameservers, contacts, and exports.

Generate a dnsmasq DHCP scope config with pool checks, router and DNS options, static reservations, PXE/TFTP lines, and audit exports.