Free Domain Checker: DNS Records, SSL Expiry, SPF & DMARC

Domain check

Enter a domain to see its DNS records, SSL certificate, the HTTP response of its homepage, its email records (MX, SPF, DMARC) and, when available, the registrar and expiry date. The check runs from our server and needs no sign-up.

You can paste a full URL and only the domain is used. IP addresses and internal domains are not supported. Checks run from our servers, up to 5 per visitor per minute.

What this tool does

DNS, certificate, website and email records in one place
Enter a domain and we query its A, AAAA, CNAME, MX, NS, TXT, CAA and SOA records, read the SSL certificate's issuer and validity, request the website's homepage, and look up MX, SPF, DMARC and common DKIM selectors. Everything appears on one page, split into tabs.
Certificate problems stay visible
When a certificate is expired, self-signed or issued for another name, we still read its details and show why validation failed. A certificate with under 14 days left, or a domain with under 30 days left, is flagged under Worth a look, so you don't need a second tool to investigate.
Recognizes DNS, email and network providers
The DNS provider is recognized from the NS records, the mailbox and sending services from MX and SPF, the owning network from the ASN of the resolved IP, and the edge platform from the Server header. These are rough guesses from public records, and anything we can't recognize is left out rather than guessed.
Public information only, no subdomain discovery
The tool reads only public DNS, certificate, HTTP response headers and RDAP registration data. The email check uses DNS only: no mail is sent and no mail server is contacted. We don't enumerate subdomains and have no DNS query logs, and we won't invent that kind of data on the page.

How to use it

Type a domain such as example.com, or paste a full URL and only its domain is used. IP addresses, localhost and internal suffixes such as .local and .internal are not supported.
Click Check. The server queries DNS, reads the certificate on port 443, requests the homepage once, and looks up registration and email records at the same time. It usually takes a few seconds, and repeating a check for the same domain within 5 minutes reuses the cached result.
Start with Overview: the number of resolved IPs, the days left on the certificate and domain, the HTTP status code and the Worth a look list. Then read the Identified services summary for the DNS, email and network providers.
Open the DNS records, SSL certificate, HTTP, Email and Registration tabs for details.
Click Export JSON or Export CSV to save the whole result. Each visitor can run 5 checks per minute.

Every check explained

What each tab shows, how it is obtained and which limits apply.

DNS records: A, AAAA, CNAME, MX, NS, TXT, CAA and SOA are queried together, with up to 30 records shown per type and a 4-second timeout per type. A type that timed out or failed is marked as such rather than treated as having no records. If the system resolver is unavailable we fall back to 1.1.1.1 and 8.8.8.8.
SSL certificate: Only port 443 is checked. It shows the subject, issuer, valid-from and expiry dates, days remaining, TLS version and the names the certificate covers (SAN, up to 20 shown with the total count). The details are read even when the certificate is invalid.
Certificate validation: The certificate is validated against the system's trusted root certificates and the host name. If it fails, the reason is named: expired, not yet valid, self-signed, untrusted issuer or incomplete chain, or a name mismatch.
HTTP observation: One GET request to https://domain/ that reads only the response headers. It shows the final URL, status code, Server, Content-Type, response time and the number of redirects. Up to 3 redirects are followed manually, each hop is re-resolved and checked to be public, and the total budget is 10 seconds.
Cloudflare challenge: When a Cloudflare response is 403, 429 or 503, the first 4 KB are read to tell whether it is a human-verification page. If so it is flagged, so the verification page isn't mistaken for the website's own content.
Email records: MX (mail servers, including a Null MX declaration), SPF (what the trailing all means and which domains it includes), DMARC (policy, subdomain policy, percentage, whether reports are configured) and the public keys of the 8 most common DKIM selectors. All of it comes from DNS queries; no mail is sent and no mail server is contacted.
Identified services: The DNS provider (from NS records, 18 recognized), the mail provider (from MX), sending services (from SPF includes), the owning network (ASN, name, country of the resolved IP) and the edge or hosting platform (from the Server header). Only what is recognized is shown.
Registration: From a public RDAP service on a best-effort basis: registrar, creation date, expiry date, days remaining and status codes. Not every domain suffix publishes RDAP and some fields are hidden by registries; when nothing is found the tab doesn't appear.
Worth a look: Only facts that were observed: a non-public address, DNS types that timed out, no IPv6, a certificate that is expired or expires within 14 days, a certificate that failed validation, an HTTP status other than 2xx, a domain expiring within 30 days, MX without SPF or DMARC, SPF ending in +all, and a DMARC policy of none.
Export: JSON is the complete structured result. CSV is a flat table of section, item and value with fixed English item names for easy scripting. Exporting happens in your browser and makes no further request to our server.

Domain checker FAQ

Where does the check run from?

From our server: the DNS queries, a TLS connection to port 443, and one GET request to https://your-domain/ (response headers only, the first 4 KB when needed, and up to 3 redirects). You see the result from our server's location, which can differ from what your own network sees.

How do I check how many days are left on an SSL certificate?

After you run the check, the Overview shows the days remaining on the certificate, and the SSL certificate tab shows the expiry date and days left. Under 14 days is flagged under Worth a look. The tool reads the certificate as it is right now: it does not monitor continuously or email expiry reminders, so repeat the check on a schedule if you need that.

Can I check SPF, DMARC and DKIM? What are the limits?

Yes. The Email tab shows MX, SPF and DMARC, and tries the 8 most common DKIM selectors (default, google, selector1, selector2, k1, s1, s2, mail). A DKIM selector can be named anything, so not finding one doesn't mean DKIM isn't set up. It uses DNS queries only: no mail is sent and no mail server is contacted.

Why were the SSL and HTTP checks skipped for some domains?

To stop this tool being used to probe internal networks, a domain that resolves to even one non-public address (private, loopback, link-local and so on) only gets its DNS records shown, and we don't connect to it. IP addresses, localhost and internal suffixes such as .local and .internal are not supported either.

Do you store the domains I enter?

The domain itself is not saved to a database and analytics events never contain it; the complete check result is cached in server memory for 5 minutes. The domain is sent to DNS resolvers and the public RDAP service (rdap.org), and its own server is contacted. The first public IP it resolves to is checked against our shared result database first and is sent to IP2Location.io, ipapi.is and proxycheck.io only on a database miss.

Can I find subdomains or monitor a domain over time?

No. This tool doesn't discover subdomains, and it has no DNS query logs or history: every check is a one-off snapshot of the current state. That kind of data needs long-term collection that we don't have, so we don't show it. To find subdomains, use a dedicated tool such as certificate transparency logs.