TTL profile
How quickly a change to these records would take effect.
Charts appear here once you run an analysis.
DNS & SSL Inspector FREE
Look up DNS records and inspect the SSL/TLS certificate for any domain, all in one place.
Free to use
No registration
Privacy-first
Enter a domain to inspect
All checks are performed from our servers. We do not store or share your data.
Visual analytics
How the domain is published and protected
The records this resolver returned and the certificate this handshake presented, read four ways.
Records by type
Which record types this domain actually publishes.
Charts appear here once you run an analysis.
Certificate lifetime
How much of the issued validity window is left.
Charts appear here once you run an analysis.
Email authentication
Whether the domain publishes the records that stop it being spoofed.
Charts appear here once you run an analysis.
Use cases
When to inspect a domain
DNS and TLS fail on a schedule nobody remembers setting.
Before a migration
Read the current TTLs so you know how long the old answers will keep circulating after you change them.
Certificate renewal season
See the remaining validity window against the issued lifetime, rather than a date on its own.
Investigating email delivery
Check whether MX, SPF and DMARC are actually published before blaming the mail provider.
Scope and limits
One vantage point, not the whole internet
Everything here is a single lookup from one place at one moment.
No global propagation claim
The records shown are what one recursive resolver answered for this query, and the certificate is what one TLS handshake from our server presented. Other resolvers, regions and network paths can legitimately answer differently, especially soon after a change. DKIM is not reported as absent, because a DKIM record lives under a selector name that cannot be enumerated: if it is not checked, we say so instead of guessing.
Help
FAQ
What people ask after a lookup.
I changed a record and it still shows the old value. Why?
Caching. Resolvers keep an answer for as long as its TTL says they may. The TTL profile chart is there precisely to tell you how long that will be.
Is this a global propagation check?
No. It is one lookup from one resolver. A propagation check queries many resolvers in many regions; this tool deliberately does not claim to.
Why is DKIM not checked?
DKIM keys are published at selector._domainkey, and the selector is chosen by whoever sends your mail. There is no way to list selectors from outside, and guessing common names would report a confident absence that means nothing.
What does an expiring certificate actually break?
Browsers refuse the connection with a full-page interstitial, and API clients usually fail outright. It is one of the few problems that takes a whole site down at a precise, predictable second.
Cybersecurity Basics for Business Websites and Web Applications
Most incidents are not sophisticated attacks. They are old problems, outdated software, reused passwords, exposed admin panels, that never got addressed. These are the fundamentals that prevent the majority of trouble.
Read article
HTTP Security Headers: CSP, HSTS, Permissions Policy and a Complete Configuration
HTTP security headers let a server tell the browser how scripts may be loaded, whether a page may be embedded, which device capabilities may be used, how much referrer information should be sent, how MIME types must be interpreted and whether the site may ever be reached over plain HTTP. A well-designed policy reduces the impact of several classes of attacks, including cross-site scripting, clickjacking, MIME confusion, XS-Leaks and unsafe cross-origin embedding.
Read article
Fortify vs Checkmarx One vs Veracode vs Snyk vs GitHub Code Security vs Semgrep: which enterprise AppSec platform should you choose in 2026?
An enterprise asks for “one security scanner”, but the real requirement normally contains several independent problems:
Read article