DNS & Domain Inspector

A domain is several independent systems wearing one name. A registry knows who registered it and when it lapses. Its nameservers know what it resolves to. The network it resolves into belongs to somebody else again. And the machine at the far end presents a certificate, sends headers, and serves a page built out of software with its own licences.

an expiry date beside a certificate date, a nameserver beside the CDN it points at, an SPF record beside the MX records it is supposed to cover

Asking each of them separately is four tools and a terminal; this asks all of them at once and puts the answers side by side, which is usually where the interesting part is. Nothing here is privileged information — every answer comes from a service that publishes it deliberately: the DNS, the registry, the routing registries, and the site's own responses.

Each panel answers one question, from one source.

Above them sits a strip of six readings — addresses, network, registrar, domain expiry, certificate expiry and header grade — each tinted by whether it needs attention. It is there so the question "is anything wrong with this domain" can be answered without opening a single panel, and so the panel that does need reading is the one with a coloured rail down its edge.

Nine types are queried at the apex, and every answer keeps its TTL, so you can see how long an old answer will linger after a change.

After you change a record, the question is not whether the registry accepted it — it is whether the resolvers people actually use have caught up. Every recursive resolver keeps its own cache and does its own resolution, so for as long as the old record’s TTL has left to run, some will answer with the new value and some with the old. That divergence is what a change in flight looks like from outside, and the propagation card is nine independent operators asked the same question at the same moment.

Nine operators is not nine locations. Every query leaves this server, so an anycast service such as Cloudflare or Google answers from whichever of its nodes is nearest this server, not from the country its pin sits in. The map shows where each operator runs its service, which is a fact about the operator; it is not a claim that the query travelled there. A tool that drew nine flags and implied nine vantage points would be easier to build and would be lying to you.

Disagreement also has a second, entirely healthy cause. A name can be configured to answer differently depending on where the asker is — GeoDNS steering, which is how many large sites hand visitors a server near them. Ask nine resolvers about github.com on a perfectly ordinary day and you will get several different addresses back. From a single vantage point, that is indistinguishable from a change still spreading, so the card says so rather than colouring it as a fault.

Read it, then, as a comparison and not a verdict. Every resolver agreeing means the change has reached all nine caches. Some disagreeing means either the change is still spreading or the name steers by region — and the TTL beside each answer is the number that tells you how long the stale ones can still be stale.

Two settings and three buttons. Nothing else changes what is looked up.

Every technology this recognises carries the licence it ships under: an SPDX identifier where the project publishes one, and the literal Proprietary where none exists. WordPress is GPL-2.0-or-later, nginx is BSD-2-Clause, Cloudflare is not licensed to anybody. Each identifier links to its own SPDX page.

That is the licence of the software, not of the words on the page. Where a site declares terms for its own material — a rel="license" link, or the older meta tag — it is shown separately in the HTTP panel, exactly as the publisher wrote it.

Both are claims worth checking rather than facts to rely on. A version is whatever a header or a filename admitted to, a licence is what that project used at the time this table was written, and neither is legal advice. Read the project's own LICENSE before you build on it.

Every other tool here is offline by design. This one cannot be. A web page cannot make a DNS query, cannot speak RDAP, and cannot open a raw TLS connection to read a certificate — all of that happens on our server, on your behalf.

In practice: the name you type is sent to us, and from there to the resolver you picked, to the registry's RDAP service, and — if the site fetch is on — to the host itself, which sees one request from our address identifying itself as ToolForgeBot. Nothing is written to a database, and the report exists only in the tab in front of you.

The challenge is there for the same reason. An endpoint that fetches whatever host a stranger names is a scanner and an open proxy if it is left unguarded, and the traffic would arrive at other people's servers carrying this site's name. Addresses on private, loopback, link-local and reserved ranges are refused outright — on every redirect hop, not only the first.

Where the machine physically is. The country shown is the one the routing registry records for the address block, which is where it was allocated rather than where it is plugged in. City-level geolocation needs a commercial database, and is still a guess.

Whether a site is safe, or whether a header is any good. The header grade counts how many of six were sent; it says nothing about whether a Content-Security-Policy is meaningfully restrictive or an HSTS max-age is long enough. Grading contents is a different tool, and a confident letter on a guess would be worse than no letter at all.

Anything a registry declines to publish. Registrant names and addresses have been redacted from gTLD records since 2018, and some country registries run no RDAP service at all — those say so, and point you at the registry's own WHOIS.

The lookups that actually get run: