The sysadmin jobs you keep doing by hand

Your three mail records, and what each is missing

Reads all three at once and counts the DNS lookups your SPF spends of the ten it is allowed. For DKIM it says how many selectors were tried, because the DNS does not let anyone list them — so “no DKIM” is never a fact, and every other page prints it as one.

Not the DNS record — the policy itself

The DNS record only says a policy exists; everybody checks that and stops. This fetches the policy, says whether it enforces anything or is still in testing mode, and compares its mail servers with the ones the domain actually publishes.

Where a message went, and what it cost

Turns the chain around so you read it in the order the message travelled, names the delay at every hop, and says when the clocks disagree instead of printing a negative delay as if it were one. Nothing is stored.

Is this IP on a blacklist

Asks the eight lists that actually block mail today and says which ones answered, which listed you and which stayed silent — because “7 of 8” does not tell you whether the missing one is the list your recipient consults.

Refused or silent — not both called “closed”

A refusal means the machine answered and nothing is listening: you start the service. Silence means a firewall ate the packet: the rule is somewhere else entirely. Every other checker calls both closed. Reads the service greeting too, because a handshake does not prove the protocol.

What the DNS says about a domain

Nameservers, MX, A, AAAA, SPF and DMARC in one look — and, unlike most of these pages, a record that did not answer is never drawn like a record that is empty: one means this domain gets no mail, the other means nothing at all.

Asks your nameservers, not just caches

DNS does not propagate — each cache holds its copy until the old TTL runs out. Caches disagreeing is normal; your own nameservers disagreeing with each other is a broken zone that waiting will not fix, and that is what asking each of them one by one shows.

Whose domain it is, and until when

Read from the registry itself. Says whether the transfer lock is on — the thing that stops a domain being stolen — and, when a registry cannot be read, which of the five reasons it is instead of a blank page.

Signed is not the question — validating is

Everybody tells you whether a domain is signed. The state worth finding is the other one: a signature that does not validate, which makes the domain vanish for every resolver that checks while it still looks perfect from one that does not. Two validating resolvers are asked, and a disagreement between them is said rather than averaged.

When it expires, and whether it fits

Reads the certificate on any port — 993 and 465 included, which no browser will show you — and separates the two failures that look identical: one that does not cover the name you asked for, and one whose chain cannot be validated.

Your six headers, judged by what they DO

Every other checker grades by presence. A header can be present and do nothing: max-age=0 turns HSTS off, a policy in Report-Only blocks nothing, and frame-ancestors makes the browser ignore your X-Frame-Options. All three read as done, and all three come back here as switched off.

Is that site down, or is it just you

Checked from here, which is the only thing you cannot do yourself. Says whether it answers, whether it answers badly, and whether the name even exists — and if this server is the one having trouble, it says that instead of blaming the site.

Download, upload and latency

Discards TCP slow start, uses several connections and times them by the wall clock. Says what it threw away and when a run was too short to believe.

Your address, and what kind it is

IPv4 or IPv6, its reverse DNS, and whether your ISP has you behind CGNAT — which is the real reason port forwarding will not work. Answers in plain text from a terminal too.

Passwords and passphrases, in your browser

Generated with the system random number generator and never sent anywhere. The strength shown is counted exactly, including what requiring a symbol takes away.