Free security tools

Small tools for the questions that come up every day around e-mail and domains. Free, no account, and most of them run entirely in your browser.

• Runs in your browserSecurity monitoring resale calculator for agenciesYour number of client sites and your price per site: the plan you need, your cost, your monthly margin and break-even, with an offer and an e-mail to copy.Open the tool →
• Runs in your browserNIS2 scope checker: am I covered?Your sector, your size, your country: whether NIS2 makes you an essential or an important entity, the article that decides it, and where the law stands in France, Germany and Ireland.Open the tool →
• Runs in your browserSPF record checkerIs the SPF record valid? Its syntax, the DNS lookups it costs against the limit of 10, include by include, and the cause of a permerror.Open the tool →
• Runs in your browserDMARC checkerDoes the DMARC policy stop forged mail? Policy, subdomains, pct, where the reports go and whether those addresses accept them.Open the tool →
• Runs in your browserDKIM record checkerLook up the DKIM key of a selector, or try the common ones: key type and size, revoked keys and syntax errors.Open the tool →
• Runs in your browserFull e-mail authentication checkCan someone send mail in your name? SPF, DKIM and DMARC at once, with MX, MTA-STS, TLS-RPT, BIMI and an overall verdict.Open the tool →
• Runs in your browserE-mail header analyzerPaste the headers of a message: its route server by server, the delays, SPF, DKIM and DMARC, and the signs of a forgery.Open the tool →
• Runs in your browserDMARC report readerDrop the XML, .gz or .zip reports your rua= address receives: every server that sends mail as your domain, and which ones fail.Open the tool →
• Runs in your browserSPF record generatorTick the services that send your mail and get one valid SPF record, its DNS lookups counted before you publish it.Open the tool →
• Runs in your browserDMARC record generatorChoose the policy, the report addresses and the alignment, and get the _dmarc record to start at p=none and move to reject.Open the tool →
• Runs in your browserDNS record generator: SPF, DMARC, CAA, MTA-STS, security.txtBuild the records that protect a domain’s mail and certificates, each setting explained, the SPF lookup count checked.Open the tool →
• Checked from our serversBIMI checkerCan mailboxes show your logo next to your messages? The BIMI record, the SVG Tiny PS logo, the mark certificate (VMC or CMC) and the DMARC policy they require.Open the tool →
• Checked from our serversMTA-STS and TLS-RPT checkerMust mail to the domain arrive encrypted? The _mta-sts record, the policy file as a sender fetches it, each MX host against the policy, and the TLS-RPT record.Open the tool →
• Checked from our serverssecurity.txt checkerDoes the domain tell researchers how to report a vulnerability? Where the file is, the Contact and Expires fields, the expiry date, and the errors that make tools ignore it.Open the tool →
• Runs in your browserDNSSEC checkerIs the zone signed, and does a validating resolver accept it? The DS record at the parent, the keys, the algorithms, and a broken chain told apart from a zone that is down.Open the tool →
• Runs in your browserCAA record checkerWhich certificate authorities may issue for a domain or a subdomain: the records that apply and where they are published, wildcards, the iodef address and the errors.Open the tool →
• Checked from our serversCertificate and security headers checkerCertificate validity and expiry, TLS version, HTTPS redirect, HSTS, CSP and the other headers that protect a website’s visitors, with a grade.Open the tool →
• Checked from our serversSubdomain finder and DNS mapFind the subdomains of a domain in the certificate logs and see its records, their addresses and who runs them, drawn as one interactive map. Public sources only, for cybersecurity research.Open the tool →