Free DNS, SSL and hosting tools

The tools

• DNS propagation checker: asks 20 public resolvers, from DNSPeek's server, for an A, AAAA, CNAME, NS, MX or TXT record and compares the answers with the value you expect (a TXT value is compared as the whole record). It says when the name does not exist or has no record of that type, counts resolvers that timed out, refused or failed, and reports a DNSSEC validation failure (usually a stale DS record after a nameserver move). Without a value, answers that only rotate within one network count as consistent. It counts a domain as propagated with the same rule as the dashboard's DNS check.
• SSL checker: the certificate on port 443, its expiry date, issuer, the names it covers, whether browsers trust its chain and why not (expired, not yet valid, missing intermediate, private root), and the TLS version. A server that only speaks TLS 1.0 or 1.1 is named as such. Behind a CDN such as Cloudflare it shows the CDN's edge certificate, the one visitors see.
• Redirect checker: follows http://your-domain/ (or https://, or a path you enter) hop by hop, up to 10 redirects, and flags loops, temporary redirects, a missing HTTPS upgrade, untrusted certificates on HTTPS hops and a chain that ends on another site. When bot protection (Cloudflare, Sucuri, Akamai, AWS WAF) answers instead of the site, it says so: visitors with a browser may still get the page.
• Security headers check: grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy from A+ to F, on the page https://your-domain/ ends on. A redirect loop, a connection failure, an error page or a bot-protection page is shown as not graded, with the reason. Behind a CDN the headers are the ones its edge sends.
• Who is hosting: the domain's CNAME chain and IP addresses with the network that owns them (ASN, organisation, the network's registration country), a CDN in front of the site (recognised by CNAME, reverse DNS or network), and the DNS and email providers, all of them when the nameservers mix providers.
• Hosts file generator: the hosts file lines for your domain and new server IP (and its IPv6, so an old AAAA record can't win), with steps for Windows, macOS and Linux, including the browser's own DNS cache. It warns when HSTS will block a server without a valid certificate. It runs entirely in your browser.

Migration and DNS tools

• TTL checker: the configured TTL of each record, read from the zone's own nameserver, and how early to lower it before you change the IP. It also shows the TTL the registry gives the delegation: after a move to new nameservers, resolvers may keep asking the old ones that long (often 48 hours), however low the zone's TTLs are. Wildcard records and mail-only names are noted.
• Nameserver checker: the nameservers the registry delegates to, asked from the TLD's own servers, compared with the NS records inside the zone. Every address of every nameserver is asked, with lame servers flagged. SOA serials are compared within one provider only, so a zone served by two providers (for example NS1 and Route 53) isn't reported as out of sync. It also matches the registry's DS record against the DNSKEY on the nameservers: a stale DS left after a move makes validating resolvers fail the whole domain. IPv6-only addresses are listed but not asked, because the checker has no IPv6 connectivity.
• DNS compare: A, AAAA, CNAME, MX, TXT, NS and CAA side by side from two nameservers, or from public DNS and the new host's nameserver, so missing records show up before you switch nameservers. Addresses are asked three times per side, so round-robin answers aren't reported as differences. Shortcuts compare www, _dmarc and a DKIM selector too.
• Is my domain switched?: how many of the 20 public resolvers already return your new server IP (IPv4 or IPv6), leftover records of the other address family, and whether that server answers for the domain over HTTP and HTTPS with a valid certificate and without redirecting to another site.

Email tools

• MX lookup: the mail servers in priority order, their addresses and provider, plus whether SPF and DMARC exist (a subdomain falls back to the main domain's DMARC, as receivers do) and DKIM keys under common selectors such as google and selector1.
• SPF checker: parses the SPF record, follows every include and counts DNS lookups against the limit of 10, an include used twice counting twice. It also counts lookups that return nothing (limit 2). Flags +all, ?all, loops, a missing record and more than one record.
• DMARC checker: parses the policy, pct and report addresses, and warns about p=none, sp=none under a stricter policy, missing reports and report domains that have not authorised them.

The DNS-only tools (propagation, TTL, DNS compare, MX, SPF and DMARC) also accept service names such as _dmarc.example.com or selector1._domainkey.example.com.

Sites on Cloudflare

Cloudflare gives each region its own edge address, so resolvers return different Cloudflare IPs for the same site, for example 188.114.96.3 in one place and 104.21.66.63 in another. The DNS propagation checker (for A and AAAA) and Is my domain switched handle this:

• The IP you expect is a Cloudflare address: a resolver counts as matched when every address it returns is in Cloudflare's published ranges, whichever edge it got. A result like "served through Cloudflare on all 15 resolvers that answered" is a finished switch. While a move onto Cloudflare spreads, resolvers still returning the old host count as not switched yet.
• The IP you expect is your own server, but the domain is behind the Cloudflare proxy (orange cloud): every resolver returns Cloudflare's addresses, never your server, so DNS cannot show the switch. If you changed the origin IP inside Cloudflare, it applies within seconds. The tools say so instead of showing a percentage. Is my domain switched still asks your new server directly, and a preview link with your server IP as the target shows the whole site from it, past Cloudflare.

Answers that are all Cloudflare addresses are tagged Cloudflare in the resolver list, next to the raw IPs.

Get an email when DNS has propagated

The DNS propagation checker shows the state right now. To be told when the change is done, click Email me when it's done under the result, create the preview link it fills in for you, and turn on Alert me when DNS has propagated in the link settings.

Limits

• Each tool allows 10 checks a minute and 100 a day from one network. Over the limit, the page tells you how long to wait.
• Repeating the same check within a minute shows the same result and does not count toward the limit. A check that failed on the way (a timeout, no answer) is not reused: running it again checks again.
• The limit is per network: one IPv4 address, or one IPv6 /64. The X-RateLimit-* response headers describe DNSPeek's general API limit, not the per-tool one.
• The tools accept a domain name only, not an IP address, port or path. Pasted URLs are reduced to the domain. DNS compare also takes a nameserver hostname or public IP, and Is my domain switched takes the new server IP.
• Domains, nameservers and server IPs that are private, reserved or DNSPeek's own addresses are not checked.
• Requests to your site come from DNSPeek's servers with the user agent DNSPeek-Tools/1.0. The tools read response headers and certificates only, never page content.
• Who is hosting uses Team Cymru's public IP-to-ASN data. Behind a CDN, it shows the CDN, not your server: see Find your server IP.