Free Diagnostic Tools
Fast, free checks for your domain, website and email — run from the same global infrastructure that powers WatchFor monitoring. No signup, no setup, just the answer.
Drop in any URL and get a complete picture of your website's health in seconds — is your domain about to expire, is HTTPS set up right, is your DNS in good shape, is your email protected from spoofing? One scan, one easy-to-read scorecard, no signup.
- Domain expiry & WHOIS
- HTTPS + SSL certificate
- DNS records
- CDN detection
- Email security (SPF, DKIM, DMARC)
- HTTP/2 & HTTP/3 support
Run a full Google Lighthouse audit on any URL and see what real users feel — Largest Contentful Paint, Cumulative Layout Shift, Time to Interactive, plus the loading filmstrip frame-by-frame and the top opportunities to fix. The same metrics PageSpeed Insights uses for your search ranking.
- Performance, Accessibility, SEO scores
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Total Blocking Time + TTI
- Loading filmstrip frame-by-frame
- Top fixes ranked by impact
DNS
- DNS Lookup
Resolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.
Run the check - DNS Propagation
Check how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map.
Run the check - Whois Lookup
Modern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.
Run the check
Network
- Ping
ICMP echo request — round-trip time, jitter, packet loss.
Run the check - Traceroute
Trace the network path hop by hop with per-hop latency (MTR-style).
Run the check - Port Checker
Test TCP port reachability and optionally grab the server banner.
Run the check - Blacklist Check
Test an IP or domain against 15+ DNS-based blocklists (RBLs).
Run the check - What Is My IP
See your public IPv4 / IPv6 address, approximate location (city, region, country), timezone and map coordinates — detected instantly from your connection, no signup.
Run the check
Web
- Sign upMCP Server Checker
Test a Model Context Protocol server: initialize handshake, protocol version, capabilities and the full tool inventory.
Sign up to run - SSL Certificate Check
Inspect certificate validity, expiry, SANs, issuer and chain trust.
Run the check - HTTP Headers
Inspect response headers, status, redirect chain and security headers.
Run the check - CDN Checker
Detect which CDN (Cloudflare, Akamai, Fastly, and more) serves a site, from its DNS and response headers.
Run the check - Sitemap Checker
Find and validate a site's XML sitemap — total URL count plus a sample crawl for broken (4xx/5xx) links.
Run the check - Brotli Checker
Check whether a site serves Brotli-compressed responses (Content-Encoding: br) for faster page loads.
Run the check
- Email Health
Combined SPF + DKIM + DMARC grade with per-record diagnostics.
Run the check - SPF Checker
Validate and recursively expand the SPF record, with mechanism breakdown.
Run the check - DKIM Checker
Validate DKIM public key for a selector — algorithm, key size, format.
Run the check - DMARC Checker
Validate the DMARC record with tag-by-tag explanation and warnings.
Run the check
Why these instead of MXToolbox or dig?
Free diagnostics aren't new — MXToolbox, dnschecker.org and dig have covered this for years. Here's where ours are different:
- Real infrastructure. Every check runs from the same global prober fleet that powers our paid monitoring — not a single VPS that throttles after a few hundred requests. Geographic spread and headroom included.
- Honest results. No upgrade-to-see-more gates, no ad clutter, no fake-warning upsells. You get the exact same output our paying customers see — just without saved history and always-on monitoring.
- One click to keep watching. If a check finds a problem, turn on 24/7 monitoring for it right from the result — same tool, same infrastructure, no copy-pasting into a second product.
Prefer the terminal? dig, mtr and openssl still win for scripting and exact protocol control. These shine when you want to share a result, check from another location, or skip remembering the flags.
How the tools work
Every tool runs the same probe under the hood. You click Run, we rate-limit the request by IP, hand it to our global prober fleet to do the real protocol-level check (DNS query, TCP handshake, ICMP echo, TLS, HTTP…), and render the result. Probes are written in Go, run with sane 5–10s timeouts, and return their native output — not a reformatted-for-marketing summary.
A few things we deliberately don't do:
- We don't save your queries. Just enough is kept to enforce rate limits (IP + tool + time) — there's no searchable log of what you checked.
- We don't run from your browser. The check happens on our servers, so the result is free of your ISP, firewall, VPN or extensions. For the browser view, use DevTools.
- We don't oversell one check. A single run is one moment from one place — intermittent or regional issues won't always show. If it matters, monitor it continuously.
Run this check on every change, not just once.
Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card.
Start freeFrequently asked questions
Are these tools really free, or is there a hidden catch?
How are these different from MXToolbox, dnschecker.org, or dig from the terminal?
dig and mtr give you the same data — these tools win when you want to share the result with a colleague or run from a different geographic vantage.Do you log my queries?
Can I check my private internal hostname?
*.internal, *.local, RFC1918 IPs) are blocked at the input layer. If you need to verify private/internal connectivity, the paid plan supports private prober regions you deploy inside your own VPC.