Lookproof

Split an IPv4 or IPv6 CIDR block into subnets of a longer prefix, in order, at most 256 at a time; a larger split is refused before anything is computed. Offline. Use when an agent must plan an address layout or hand out subnets. Input: ?cidr=192.0.2.0/24&prefix=26.

Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcard certificates, iodef, unknown critical tags and invalid values. Use when an agent must tell which certificate authorities may issue for a domain, or why a certificate request is refused because of CAA.

Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA-1 digests and DS records without a matching key. Use when an agent must tell whether a domain is signed, why it fails on validating resolvers, or whether a key rollover left the chain of trust broken.

Resolve chosen DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV) for a name through public resolvers, with TTL, observation time and the resolver that answered. Use when an agent needs the current public DNS answer for a name, for example to confirm that a record change is visible or to read a TXT verification record.

One report on a domain's mail and DNS security: MX, SPF, DMARC, common DKIM selectors, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and CAA in one call, each as its own section with coded findings and evidence. Use when an agent must audit a domain's email security or build a domain health report; cheaper than calling the nine checks one by one. No score is computed.

Look up a domain's registration at its registry over RDAP (RFC 9083, servers from the IANA bootstrap file): registrar and IANA id, creation, change and expiry dates, EPP statuses such as hold or pending delete, nameservers and DNSSEC delegation. Contact data is never returned. Use when an agent must tell when a domain expires, whether it is locked against transfer or why it suddenly stopped resolv

Follow a site's redirect chains from http:// and https:// and read the security headers of the final HTTPS response: HSTS with preload readiness, Content-Security-Policy with unsafe-inline detection, X-Content-Type-Options, frame protection, Referrer-Policy and cookie flags (never values). Use when an agent must tell whether a site forces HTTPS, why HSTS preload fails or which headers are missing.

Check a domain's BIMI record (<selector>._bimi, default selector, with fallback to the organisational domain): v=BIMI1 syntax, HTTPS logo and certificate URLs, an SVG logo path and whether DMARC is enforced at quarantine or reject with pct=100. Use when an agent must tell why a brand logo does not show in mail clients. The logo and certificate are not downloaded.

One report on a domain's mail setup: MX, SPF and DMARC, plus DKIM for the selectors you give, with coded findings and an overall status. Use when an agent needs a complete overview of a domain's email authentication and delivery configuration in one call instead of four.

Run the mail configuration check (MX, SPF, DMARC) on up to 20 domains in one request. Results keep the input order, and items that fail for a technical reason come with a token for a free retry. Use when an agent must audit many domains at once, for example a customer list or a portfolio of brands.

Fetch and validate the DKIM public key record at selector._domainkey for a domain: key type, key size, revocation and syntax, with coded findings. Use when an agent knows the selector (s= in a DKIM-Signature header) and must confirm that the key is published and usable. It does not verify message signatures.

Try 27 common DKIM selectors (Google, Microsoft 365, Mailchimp, SendGrid, Mailgun, Zoho, Proton, Fastmail, Mailjet, Amazon SES and generic names) for a domain and validate every key found: type, size, revocation and testing flag. Use when an agent needs a domain's DKIM keys but does not know the selector. Finding none is a hint, not proof that DKIM is missing.

Look up the DMARC record of a domain or its organisational domain and explain policy, subdomain policy, alignment and reporting addresses, with coded findings. Use when an agent must tell whether a domain is protected against spoofing, which policy it enforces, or why DMARC reports do not arrive.

Check a domain's MTA-STS setup (RFC 8461): the _mta-sts record, the HTTPS policy file with certificate check and no redirects, mode, max_age and whether every MX host is covered, plus the TLS-RPT record (RFC 8460). Use when an agent must tell whether inbound mail is protected against TLS downgrade, or why senders report MTA-STS failures for a domain.

List a domain's mail servers in preference order and detect null MX (RFC 7505) and MX targets that do not resolve, with coded findings. Use when an agent must find where mail for a domain is delivered or why a domain cannot receive mail.

Name the mail providers a domain uses from its MX hosts and SPF include tree: the mailbox provider behind the primary MX, inbound gateways and sending services, matched against a fixed, versioned list with the matching names as evidence. Use when an agent must tell who hosts a domain's mail, which services may send for it, or whether SPF still authorises a provider the domain has left.

Check reverse DNS for a domain's mail servers: up to five MX hosts, their IPv4 and IPv6 addresses, each PTR name and whether it resolves back to the same address (FCrDNS), with coded findings. Use when an agent must tell whether a domain's mail servers have matching reverse DNS, a common reason for rejected or spam-filed mail.

Parse and evaluate a domain's SPF record: the include and redirect tree, qualifiers and the RFC 7208 limit of ten DNS lookups, with coded findings. Use when an agent must tell whether SPF is valid, why mail from a service fails SPF, or whether one more include would exceed the lookup limit.

One report on a website's security basics: the TLS certificate on port 443 (trust, name, expiry, key), the redirect chains from http:// and https:// with HSTS, CSP, frame protection, Referrer-Policy and cookie flags, and the domain's expiry and EPP statuses from RDAP, each as a section with coded findings. Use when an agent must audit a website or build a site health report; cheaper than the three

Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain, key and signature algorithm, TLS version and coded findings for expired, expiring, untrusted, mismatched or weak certificates. Use when an agent must tell why HTTPS fails for a domain or when its certificate has to be renewed.

Convert a domain name between Unicode and punycode (A-labels) and check it against IDNA2008 and UTS 46: disallowed characters, bidi, context and hyphen rules, lengths, and mixed scripts in one label (homograph risk), per label. Offline. Use when an agent must register, compare or display an internationalised domain. Input: ?name=bücher.example.com.

Compute a CIDR block: network, first and last address, number of addresses, netmask and host mask, and whether the input had host bits set (192.0.2.5/24). IPv4 and IPv6, offline. Use when an agent must check or explain a CIDR block in a firewall, SPF or cloud configuration. Input: ?cidr=192.0.2.5/24.

Check one IPv4 or IPv6 address against up to 100 CIDR blocks and get, for each, whether it contains the address, plus the blocks that do; blocks of the other IP version never match. Offline. Use when an agent must tell whether an address is in an allow list, a provider's ranges or an SPF ip4/ip6 term. Input: {"ip": "192.0.2.10", "cidrs": ["192.0.2.0/24"]}.

Classify an IPv4 or IPv6 address by IANA's special-purpose registries (private, loopback, link-local, shared, documentation, 6to4, Teredo, NAT64 and more, with the RFC), with compressed and expanded forms, the reverse DNS name and the IPv4 form of an IPv4-mapped address. Offline. Use when an agent must tell whether an address is public. Input: ?ip=192.0.2.1.

Turn a start and end IPv4 or IPv6 address into the smallest list of CIDR blocks that covers exactly that range (at most 62 for IPv4, 254 for IPv6). Offline. Use when an agent must write a range from a provider or registry as firewall, ACL or SPF entries. Input: ?start=192.0.2.10&end=192.0.2.20.

Parse a pasted DMARC record without DNS (RFC 9989): p, sp, np, psd, t, adkim, aspf, rua and ruf, historic and unknown tags, with the same coded findings as the DMARC check, such as p=none or a missing report address. Use when an agent must check a DMARC record before publishing it. Input: {"record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com"}.

Parse a pasted SPF record without DNS (RFC 7208): mechanisms with qualifiers and values, modifiers, syntax errors, the all policy and the number of terms that need DNS lookups, with coded findings such as +all, ptr and over ten lookups. Use when an agent must check an SPF record before publishing it. Input: {"record": "v=spf1 mx include:_spf.example.com ~all"}.

Ask Cloudflare and Google the same DNS question, each alone and uncached, and compare response codes and records; different codes (such as SERVFAIL from one) are a warning, different records information. Use when an agent debugs propagation, DNSSEC or resolver-specific answers. Input: ?name=example.com&type=A.

Read a name's HTTPS records (RFC 9460, SVCB): priority, target, AliasMode or ServiceMode, alpn (h3, h2), port, IPv4 and IPv6 hints and whether ECH is published, with AliasMode conflicts and missing mandatory keys. Use when an agent checks HTTP/3 or ECH setup. Input: ?domain=example.com.

Check a zone's name servers: the NS set, the IPv4 and IPv6 addresses of up to eight servers, a single server, servers that do not resolve, all addresses in one /24 or /48, one TLD for every name and in-zone servers that need glue. Use when an agent reviews DNS redundancy or a delegation. Input: ?domain=example.com.

Check a zone's SOA record through public resolvers: primary server, contact name, serial (YYYYMMDDnn or counter), refresh, retry, expire and negative caching TTL against RFC 1912 and RFC 2308. Use when an agent must explain zone transfer timers or why a deleted name keeps answering NXDOMAIN. Input: ?domain=example.com.

Find out whether a DNS zone has a wildcard (RFC 4592): A, AAAA, TXT and MX of a random, uncached name under the domain through public resolvers, with a warning for a wildcard MX that accepts mail for every invented subdomain. Use when an agent must tell whether a subdomain really exists. Input: ?domain=example.com.

Check a pasted DNS zone file (RFC 1035 master format, up to 64 KiB) with $ORIGIN and $TTL: unreadable lines, SOA and NS at the apex, CNAME at the apex or beside other data, duplicates, mixed TTLs in a set, out-of-zone names, NS/MX targets without addresses and SOA timers. Offline. Use when an agent edits a zone before loading it. Input: {"zone": "$TTL 3600\n@ IN SOA ...", "origin": "example.com"}.

Parse a pasted Set-Cookie header as RFC 6265bis does: Secure, HttpOnly, SameSite, Partitioned, __Host- and __Secure- prefix rules, Domain, Path, Expires and Max-Age with the 400-day cap. The cookie value is never returned, only its length. Offline. Use when an agent reviews session cookie settings. Input: {"header": "__Host-sid=x; Path=/; Secure; HttpOnly; SameSite=Lax"}.

Parse a pasted Content-Security-Policy value as CSP Level 3 does: directives and sources per policy, 'unsafe-inline' and 'unsafe-eval', wildcard and scheme-only script or plugin sources, missing default-src, object-src and base-uri, and report-only mode. Offline. Use when an agent writes or reviews a CSP before it is deployed. Input: {"header": "default-src 'self'; script-src 'self'"}.

Parse a pasted Strict-Transport-Security value as RFC 6797 does: whether browsers accept it, max-age, includeSubDomains, preload, and which hstspreload.org header rules it meets. Offline. Use when an agent sets up HSTS or prepares a preload submission. Input: {"header": "max-age=31536000; includeSubDomains; preload"}.

Parse a pasted BIMI record: v=BIMI1, the l= logo and a= certificate tags, repeated or missing tags, HTTPS URLs, the .svg logo path and a missing mark certificate. Offline: the logo and DMARC are not fetched. Use when an agent writes or reviews a BIMI record. Input: {"record": "v=BIMI1; l=https://example.com/logo.svg"}.

Parse a pasted MTA-STS policy file (RFC 8461) as a sending server would: version, mode, mx patterns and max_age, lines that do not parse, testing or none mode and a short max_age. Offline. Use when an agent writes an MTA-STS policy before publishing it. Input: {"policy": "version: STSv1\nmode: enforce\n..."}.

Parse a pasted TLS-RPT record (RFC 8460): v=TLSRPTv1, exactly one rua tag and whether each report address is a mailto: or https: URI. Offline. Use when an agent sets up SMTP TLS reporting. Input: {"record": "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"}.

Check a domain's TLS-RPT record (RFC 8460) at _smtp._tls: one v=TLSRPTv1 record with exactly one rua tag of mailto: or https: report addresses. Use when an agent sets up or audits SMTP TLS reporting, alone or before MTA-STS. Input: ?domain=example.com.

Decode one pasted PEM certificate signing request (PKCS#10): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches the key. Email addresses are never returned. Offline. Use when an agent must check a CSR before sending it to a certificate authority. Input: {"pem": "-----BEGIN CERTIFICATE REQUEST..."}.

Decode one pasted PEM X.509 certificate: subject, issuer, validity and days left, DNS and IP names, key type and size, signature algorithm, CA flag, key usages, self-signed, and SHA-256 and SHA-1 fingerprints. Email addresses are never returned. Offline: no chain or revocation check. Use when an agent must inspect a certificate file before installing it. Input: {"pem": "-----BEGIN CERTIFICATE..."}

Find which DNS provider a domain's NS records point to (Cloudflare, Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Namecheap, NS1, Hetzner, OVHcloud and more) from a fixed, versioned list of name server patterns, with unknown name servers and several providers listed. Use when an agent must know where a zone is hosted before a DNS change. Input: ?domain=example.com.

Show the TTL of A, AAAA, MX, NS, TXT, CAA and SOA records with its source: exact from a validated DNSSEC signature (RRSIG Original TTL) or the resolver's remaining cache time (normally a lower bound), plus the SOA negative caching TTL. Use when an agent plans a DNS change and must know how long old records live. Input: ?domain=example.com.

List the domain verification tokens in a domain's apex TXT records (google-site-verification, MS=, Atlassian, Facebook, Apple, Adobe, DocuSign, Stripe and more) from a fixed, versioned list, with the full public token and services that have several. Use when an agent audits or cleans up old verification records. Input: ?domain=example.com.

Unfold a domain's SPF policy (RFC 7208) into merged IPv4 and IPv6 blocks: include and redirect followed as a receiver counts them (10 lookups, 2 void lookups, PermError stops), a and mx resolved with /cidr, sources per block, exists, ptr and macros listed apart, and very broad blocks flagged. Use when an agent must know which servers may send. Input: ?domain=example.com.

Read how far a domain's DMARC policy (RFC 9989) asks receivers to act on mail that fails it: none, partial or full, with the effective policy after test mode (t=y), the subdomain policy, pct, the SPF all qualifier and the gaps in plain words. Use when an agent must explain whether a domain asks receivers to stop forged mail. Input: ?domain=example.com.