thenetworkery

DNS, DNSSEC, email security, blocklists, certificates, HTTPS and registration in one report with a security grade (A+ to F) and what to fix first.

Every record for a name from its authoritative nameservers or a public resolver, or one record compared across 13 resolvers worldwide.

Is the zone signed, does the chain of trust validate, and are the algorithms current?

Tests every nameserver of a domain directly: lame or unreachable servers, NS and glue mismatches, SOA serials, open recursion, TCP and EDNS.

SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI graded, with the exact records to fix what is missing.

Paste a message's headers to see its route and delays, SPF, DKIM and DMARC results with alignment, and why it may have gone to spam.

Build an SPF record from the services that send your mail, or a DMARC record from a policy, and compare it with the one you publish now.

Is an IP, a domain or its mail servers on the spam blocklists receivers use – and how to get delisted.

Certificate, chain, expiry, hostname match, key strength and the TLS version a server negotiates.

Redirect chain, response headers and a graded check of HSTS, CSP and the other security headers.

Every publicly logged certificate for a domain and its subdomains – find forgotten hosts and unexpected issuers.

Who holds an IP address, prefix or AS number, how it is routed (origin AS, RPKI, IRR), its reverse DNS, blocklist listings and PeeringDB record, with what to fix first.

Who holds a domain, IP address or AS number – from the registry, via RDAP.

Origin AS, visibility, RPKI validity, upstreams and announced prefixes from the global routing table.

Whether a route is RPKI valid, invalid or not found, with the ROAs covering the prefix, max-length mistakes and how to fix them.

A network’s peering policy, internet exchange ports, facilities and NOC contacts from PeeringDB.

The PTR name of an IP address, whether it resolves back to the same IP (FCrDNS), and whether it looks generic.

Whether a TCP port is open, closed or filtered from the internet, from one timed connection from our server.

Subnet ranges, masks and splits for IPv4 and IPv6, IPv6 and EUI-64 address details, and merging lists into the fewest CIDRs.

Connect to a remote MCP server like an AI assistant would: handshake, tools, resources, prompts, OAuth discovery and context cost, checked against the spec.

Decode a JSON Web Token's header and claims, check alg, exp, nbf and iat, and verify its signature if you give a key; the token is never stored.

Who made a network card, from the IEEE registry – and whether the address is randomised.

Look up any DN42 object – AS, IP, prefix, maintainer, person or .dn42 domain – with everything linked to it.

Unregistered AS numbers, free IPv4 blocks and a random unused IPv6 /48 – checked against the live registry.

WireGuard, BIRD 2 and RouterOS 7 configs for a DN42 peering, following the wiki conventions.

Creates a public URL that records every request sent to it (webhooks, callbacks) for 7 days, and returns its bin id and key for the other webhook tools.

Requests a webhook URL received, oldest first: pass after_id for only newer ones, and wait_seconds to wait briefly for the next.

One request received by a webhook URL in full (every header, the body, base64 if binary) with a curl command that sends it again.