Free developer and security tools.
No account required.
Check DNS, email authentication, TLS and HTTP headers, or format, decode and generate what you work with. 28 free tools.
Popular tools
All 28 tools- Domain HealthOne check for DNS, email authentication, TLS, security headers and redirects, with a grade per area and a full report.
- DNS LookupLook up DNS records by type, including reverse (PTR) lookups for IP addresses.
- Email SecurityCheck SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI for a domain and get the records to fix them.
- MX & SMTPCheck a domain's mail servers and test SMTP connections, STARTTLS and open relay.
- Blacklist CheckerCheck whether an IP address or a domain's mail server is listed on DNS blocklists.
- TLS CheckerInspect a site's TLS certificate, expiry, issuer and negotiated protocol, with a full report.
- HTTP HeadersGrade a site's security headers and cookies and get the header lines to add.
- JSON ToolsFormat, minify and validate JSON with exact error positions, and convert CSV to JSON.
- JWT DecoderDecode JWT header and claims and verify HS, RS, PS and ES signatures in your browser.
What a result looks like
Findings are sorted by severity. Where a check can suggest a fix, a warning comes with the record or header line to paste and a Re-check button, so fixing it takes one round trip.
Domain and network checks run on our server; formatters and decoders run in your browser and work offline.
DMARC check for example.com
Needs attentionFindings
Warning: Policy is p=none (monitoring only)
Receivers deliver mail that fails DMARC as usual. This is the right first step while you read aggregate reports, but it does not stop spoofing. Once legitimate senders pass SPF or DKIM alignment, move to
quarantine, thenreject.Next step: quarantineRead the DMARC guide_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
Passed: Aggregate reports go to dmarc@example.com
Receivers send daily XML summaries of mail using your domain.
v=DMARC1; p=none; rua=mailto:dmarc@example.com. Check your own domain.Why people use XGM
- Nothing is gated. Every tool and full report runs without an account, and so do exports, share links and history.
- Warnings come with the fix. DMARC, SPF and header checks give the record or header line to paste, with a Copy button.
- Results are portable. JSON, CSV, Markdown, print to PDF, a permanent link and a snapshot you can compare later.
- 15 tools run in your browser. Formatters, decoders and generators never upload what you paste, and work offline.
- It works from scripts and AI agents. A free API returns JSON or plain text for curl, and an MCP server lets Claude Code run checks.