---
title: Free Network, DNS & Email Tools
description: 60 free tools for the network, web and email stack — DNS, SSL, RDAP/Whois, ping, traceroute, blacklist, SPF/DKIM/DMARC, an email header analyzer, plus subnet, cron, timestamp, error-budget, JSON and bandwidth calculators. No signup.
canonical: https://watchfor.io/free-tools
---

# Free Diagnostic Tools

60 fast, free checks, lookups and calculators for your domain, website and email — run from the same global infrastructure that powers WatchFor monitoring. No signup, no setup, just the answer.

[Smart Website CheckerDrop in any URL and get a complete picture of your website's health in seconds — is your domain about to expire, is HTTPS set up right, is your DNS in good shape, is your email protected from spoofing, is your address on a mail blacklist? One scan, one letter grade with the reasons behind it, no signup.Domain expiry & WHOISHTTPS + SSL certificateDNS recordsCDN detectionEmail security (SPF, DKIM, DMARC)HTTP/2 & HTTP/3 supportRun the check](/smart-website-audit)[Core Web Vitals CheckerRun a full Google Lighthouse audit on any URL and see what real users feel — Largest Contentful Paint, Cumulative Layout Shift, Time to Interactive, plus the loading filmstrip frame-by-frame and the top opportunities to fix. The same metrics PageSpeed Insights uses for your search ranking.Performance, Accessibility, SEO scoresLargest Contentful Paint (LCP)Cumulative Layout Shift (CLS)Total Blocking Time + TTILoading filmstrip frame-by-frameTop fixes ranked by impactRun the check](/core-web-vitals-checker)

## DNS 14 tools

- [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.Run the check](/dns-checker)
- [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map.Run the check](/dns-propagation-checker)
- [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.Run the check](/whois-lookup)

### Record lookups & domain checks

- [A Record LookupFind the IPv4 address a domain resolves to — every A record with its TTL, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short.](/a-record-lookup)
- [AAAA Record LookupCheck the IPv6 address a domain publishes — its AAAA records and TTLs. Confirm dual-stack is really on, catch a record that points at an address nobody listens on, and see why IPv6-only clients time out while IPv4 works.](/aaaa-record-lookup)
- [CNAME LookupSee where a hostname is aliased — the CNAME target, its TTL and the chain it resolves through. Verify a CDN or SaaS custom-domain setup, find the alias that points at a decommissioned host, and catch a CNAME placed where one isn't allowed.](/cname-lookup)
- [MX LookupList a domain's mail servers — every MX record with its priority and TTL, exactly as sending servers see it. Verify a Google Workspace or Microsoft 365 cut-over, find the leftover MX that still points at the old provider, and explain why mail is bouncing.](/mx-lookup)
- [NS LookupFind the authoritative nameservers for a domain — the NS records the world delegates to, with TTLs. Confirm a nameserver change at the registrar has taken effect, catch a lame delegation, and know which servers to query for the truth about a record.](/ns-lookup)
- [TXT Record LookupRead every TXT record on a name — SPF, domain-verification tokens, DKIM selectors, ACME challenges — in full, with quotes and string boundaries shown as published. Confirm a verification record is live before you press 'Verify' for the fifth time.](/txt-record-lookup)
- [SOA Record LookupInspect a zone's Start of Authority record — primary nameserver, admin contact, serial number and the refresh, retry, expire and minimum timers. Compare serials across servers to prove a zone transfer happened, and read the negative-caching TTL that decides how long an NXDOMAIN sticks.](/soa-record-lookup)
- [SRV Record LookupLook up service records like _sip._tls or _xmpp-server._tcp — target host, port, priority and weight for each SRV entry. Verify SIP, XMPP, LDAP, Minecraft and Microsoft 365 service discovery, and find the SRV that points at a port nothing listens on.](/srv-record-lookup)
- [CAA Record LookupCheck which certificate authorities a domain allows — its CAA issue, issuewild and iodef records, or the absence of any. Find out before a certificate order fails with 'CAA record prevents issuance', and confirm the policy covers the CA you actually use.](/caa-record-lookup)
- [Reverse DNS LookupTurn an IP address into its hostname — the PTR record for any IPv4 or IPv6 address, plus the in-addr.arpa or ip6.arpa name being queried. Check a mail server's reverse DNS before a provider rejects it, identify who a suspicious address belongs to, and confirm forward and reverse agree.](/reverse-dns-lookup)
- [Domain Expiry CheckerSee exactly when a domain expires and how many days are left — straight from the registry over RDAP, cache bypassed, with the registrar, status flags and renewal grace signals that decide whether you can still save it. Check your own domains before a lapse, or a competitor's before it drops.](/domain-expiry-checker)

## Network 7 tools

- [PingICMP echo request — round-trip time, jitter, packet loss.Run the check](/ping-test)
- [TracerouteTrace the network path hop by hop with per-hop latency (MTR-style).Run the check](/traceroute-online)
- [Port CheckerTest TCP port reachability and optionally grab the server banner.Run the check](/port-checker)
- [Blacklist CheckTest an IP or domain against 15+ DNS-based blocklists (RBLs).Run the check](/blacklist-checker)
- [What Is My IPSee your public IPv4 / IPv6 address, approximate location (city, region, country), timezone and map coordinates — detected instantly from your connection, no signup.Run the check](/whats-my-ip)
- [IP Address LookupLook up any IPv4 or IPv6 address — the network it belongs to (ASN and operator), the announced BGP prefix, the registry country and its reverse DNS name. Identify the owner of an address in your logs, check a mail server's PTR, and jump straight into a ping, traceroute or blocklist check on the same IP.Run the check](/ip-lookup)
- [NTP Server TestQuery any NTP server from a real probe location and see whether it answers, its stratum, the clock offset and round-trip delay per sample, the leap indicator and the NTP version. Verify a time server before pointing a fleet at it, and catch the one that is reachable but unsynchronised.Run the check](/ntp-test)

## Web 17 tools

- [MCP Server CheckerTest a Model Context Protocol server: initialize handshake, protocol version, capabilities and the full tool inventory.Run the check](/mcp-server-checker)
- [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.Run the check](/ssl-checker)
- [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.Run the check](/ssl-grade-checker)
- [HTTP HeadersInspect response headers, status, redirect chain and security headers.Run the check](/http-header-checker)
- [API TesterSend a real HTTP request from a probe and inspect the response — status, headers and every JSON field.Run the check](/api-tester)
- [Global CDN CheckerAnalyse how a URL is actually delivered worldwide — which CDN serves it, which edge answers in each region, whether it is really being cached, and which regions are behaving differently. Three requests from every probe location, one graded report.Run the check](/cdn-checker)
- [Sitemap CheckerFind and validate a site's XML sitemap — total URL count plus a sample crawl for broken (4xx/5xx) links.Run the check](/sitemap-checker)
- [Brotli CheckerCheck whether a site serves Brotli-compressed responses (Content-Encoding: br) for faster page loads.Run the check](/brotli-checker)
- [Redirect CheckerFollow every redirect a URL goes through — each hop with its status code, Location header and response time, the final destination, and the problems along the way: chains longer than they need to be, loops, a hop back to plain HTTP, or a temporary 302 where a permanent 301 belongs. From a real probe location.Run the check](/redirect-checker)
- [WebSocket TesterOpen a WebSocket connection to any ws:// or wss:// URL from a real probe location — handshake time, the server's remote IP, a ping/pong round-trip, and optionally send a message and check the reply against a pattern. Test a socket server the way a browser would, without writing a client.Run the check](/websocket-tester)

### Focused web checks

- [SSL Expiry CheckerCheck when a site's SSL certificate expires — days left, the exact not-after date, the issuer and whether the chain is still trusted, from a real TLS handshake. Catch a renewal that silently stopped, a load balancer still serving the old certificate, or a wildcard about to lapse across every subdomain.](/ssl-expiry-checker)
- [TLS Version CheckerSee which TLS versions a server accepts — TLS 1.3, 1.2 and whether the deprecated 1.0 and 1.1 are still on — plus the cipher suites offered for each, with a letter grade for the whole configuration. Prove a legacy protocol is really off before an audit, or find why an old client can't connect.](/tls-version-checker)
- [Security Headers CheckerAudit the HTTP security headers a URL sends — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — with the value of each and what a missing one leaves open. The same request a browser makes, from a real probe location.](/security-headers-checker)
- [HSTS CheckerCheck a site's HTTP Strict Transport Security header — whether it is sent at all, its max-age, includeSubDomains and preload directives — and whether the policy meets the requirements for the browser preload list. Find the subdomain that still lets a first visit happen over plain HTTP.](/hsts-checker)
- [HTTP Status CheckerGet the HTTP status code a URL returns right now — 200, 301, 404, 503 — with the response time, redirect count, final URL and headers, fetched from a real probe location rather than your own network. Confirm a page is really down, a redirect is really a 301, or an API is really answering.](/http-status-checker)
- [Sitemap ValidatorValidate a site's XML sitemap — is it where crawlers look, does it parse, how many URLs does it list, and do the sampled ones actually return 200? Catch a sitemap that points at redirected or deleted pages before Search Console reports them as errors.](/sitemap-validator)
- [Gzip Compression TestTest whether a site serves gzip or Brotli-compressed responses — the Content-Encoding it negotiates, the compressed and uncompressed sizes and the bandwidth saved. Find the origin or CDN path that quietly serves uncompressed HTML, and see how much a page would shrink.](/gzip-test)

## Email 7 tools

- [Email HealthCombined SPF + DKIM + DMARC grade with per-record diagnostics.Run the check](/email-policy-checker)
- [SPF CheckerValidate and recursively expand the SPF record, with mechanism breakdown.Run the check](/spf-record-checker)
- [DKIM CheckerValidate DKIM public key for a selector — algorithm, key size, format.Run the check](/dkim-record-checker)
- [DMARC CheckerValidate the DMARC record with tag-by-tag explanation and warnings.Run the check](/dmarc-record-checker)
- [SMTP Server TestConnect to any mail server on port 25, 465 or 587 from a real probe location and see what a sending server sees — the banner, whether STARTTLS is offered, whether reverse DNS matches, and whether it relays for strangers. Verify a new mail host before you route production mail through it.Run the check](/smtp-test)
- [Email Header AnalyzerPaste raw email headers and see the whole story — the delivery path hop by hop with per-hop delays, SPF/DKIM/DMARC authentication verdicts, From/Return-Path alignment and every header in a searchable table. Runs entirely in your browser: headers contain real addresses and IPs, so nothing is ever uploaded. Free, no signup.Run the check](/email-header-analyzer)
- [SPF & DMARC GeneratorBuild correct SPF and DMARC DNS r

…

---

Canonical page: https://watchfor.io/free-tools · Site guide: https://watchfor.io/llms.txt