---
title: Free Network, DNS & Email Tools
description: 64 free tools for the network, web and email stack — DNS, SSL, RDAP/Whois, ping, traceroute, blacklist, SPF/DKIM/DMARC, an email header analyzer, plus subnet, cron, timestamp, error-budget, JSON and bandwidth calculators. No signup.
canonical: https://watchfor.io/free-tools
---

# Free Diagnostic Tools

64 fast, free checks, lookups and calculators for your domain, website and email — run from the same global infrastructure that powers WatchFor monitoring. No signup, no setup, just the answer.

Graded tools share one A+ to F scale with published rules. [How WatchFor grades](/grades)

[Smart Website CheckerDrop in any URL and get a complete picture of your website's health in seconds — is your domain about to expire, is HTTPS set up right, is your DNS in good shape, is your email protected from spoofing, is your address on a mail blacklist? One scan, one letter grade with the reasons behind it, no signup.Domain expiry & WHOISHTTPS + SSL certificateDNS recordsCDN detectionEmail security (SPF, DKIM, DMARC)HTTP/2 & HTTP/3 supportRun the check](/smart-website-audit)[Core Web Vitals CheckerRun a full Google Lighthouse audit on any URL and get an A+ to F performance grade against Google's Core Web Vitals thresholds — Largest Contentful Paint, Cumulative Layout Shift, Total Blocking Time and server response time, the loading filmstrip frame-by-frame and the top opportunities to fix, each finding with its fix.Performance, Accessibility, SEO scoresLargest Contentful Paint (LCP)Cumulative Layout Shift (CLS)Total Blocking Time + TTILoading filmstrip frame-by-frameTop fixes ranked by impactRun the check](/core-web-vitals-checker)

## DNS 15 tools

- [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.Run the check](/dns-checker)
- [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map — plus an A+ to F DNS health grade for the zone: nameservers, delegation, DNSSEC and CAA.Run the check](/dns-propagation-checker)
- [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.Run the check](/whois-lookup)

### Record lookups & domain checks

- [DNS Health CheckerGrade a domain's DNS A+ to F: how many nameservers it has and on which networks, lame delegation, whether the registry and the zone agree, SOA serials, DNSSEC and CAA, with the fix for every problem. Then see what every probe location answers, on a map.](/dns-health-checker)
- [A Record LookupFind the IPv4 address a domain resolves to — every A record, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short.](/a-record-lookup)
- [AAAA Record LookupCheck the IPv6 address a domain publishes — its AAAA records, from the resolver of your choice. Confirm dual-stack is really on, catch a record that points at an address nobody listens on, and see why IPv6-only clients time out while IPv4 works.](/aaaa-record-lookup)
- [CNAME LookupSee where a hostname is aliased — the canonical name it resolves to once every CNAME in the chain is followed. Verify a CDN or SaaS custom-domain setup and spot an alias that still points at a service you stopped using.](/cname-lookup)
- [MX LookupList a domain's mail servers — every MX record with its priority, sorted the way sending servers try them. Verify a Google Workspace or Microsoft 365 cut-over, find the leftover MX that still points at the old provider, and explain why mail is bouncing.](/mx-lookup)
- [NS LookupFind the authoritative nameservers for a domain — the NS records the world delegates to. Confirm a nameserver change at the registrar has taken effect, catch a lame delegation, and know which servers to query for the truth about a record.](/ns-lookup)
- [TXT Record LookupRead every TXT record on a name — SPF, domain-verification tokens, DKIM selectors, ACME challenges — in full. A record split into several 255-character strings is shown joined, the way SPF and DKIM read it. Confirm a verification record is live before you press 'Verify' for the fifth time.](/txt-record-lookup)
- [SOA Record LookupInspect a zone's Start of Authority record — primary nameserver, admin contact, serial number and the refresh, retry, expire and minimum timers. Compare serials across servers to prove a zone transfer happened, and read the negative-caching TTL that decides how long an NXDOMAIN sticks.](/soa-record-lookup)
- [SRV Record LookupLook up service records like _sip._tls or _xmpp-server._tcp — target host, port, priority and weight for each SRV entry. Verify SIP, XMPP, LDAP, Minecraft and Microsoft 365 service discovery, and find the SRV that points at a port nothing listens on.](/srv-record-lookup)
- [CAA Record LookupCheck which certificate authorities a domain allows — its CAA issue, issuewild and iodef records, or the absence of any. Find out before a certificate order fails with 'CAA record prevents issuance', and confirm the policy covers the CA you actually use.](/caa-record-lookup)
- [Reverse DNS LookupTurn an IP address into its hostname — the PTR record for any IPv4 or IPv6 address, with its TTL. Enter a hostname instead and it resolves the name first, then looks up the PTR of each address. Check a mail server's reverse DNS before a provider rejects it, identify who a suspicious address belongs to, and confirm forward and reverse agree.](/reverse-dns-lookup)
- [Domain Expiry CheckerSee exactly when a domain expires and how many days are left — straight from the registry over RDAP, cache bypassed, with the registrar, status flags and renewal grace signals that decide whether you can still save it. Check your own domains before a lapse, or a competitor's before it drops.](/domain-expiry-checker)

## Network 7 tools

- [PingICMP echo request — round-trip time, jitter, packet loss.Run the check](/ping-test)
- [TracerouteTrace the network path hop by hop, with packet loss and average latency at each hop (MTR-style).Run the check](/traceroute-online)
- [Port CheckerTest TCP port reachability and optionally grab the server banner.Run the check](/port-checker)
- [Blacklist CheckCheck an IPv4 address against the Spamhaus ZEN, SpamCop and Barracuda blocklists (a domain is checked through the address it resolves to).Run the check](/blacklist-checker)
- [What Is My IPSee your public IPv4 / IPv6 address, approximate location (city, region, country), timezone and map coordinates — detected instantly from your connection, no signup.Run the check](/whats-my-ip)
- [IP Address LookupLook up any IPv4 or IPv6 address — the network it belongs to (ASN and operator), the announced BGP prefix, the registry country and its reverse DNS name. Identify the owner of an address in your logs, check a mail server's PTR, and jump straight into a ping, traceroute or blocklist check on the same IP.Run the check](/ip-lookup)
- [NTP Server TestQuery any NTP server from a real probe location and see whether it answers, its stratum, the clock offset and round-trip delay per sample, the leap indicator and the NTP version. Verify a time server before pointing a fleet at it, and catch the one that is reachable but unsynchronised.Run the check](/ntp-test)

## Web 19 tools

- [Software Exposure CheckerSee which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.Run the check](/software-exposure-checker)
- [HotPHP Version CheckerCheck your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup.Run the check](/php-version-checker)
- [MCP Server CheckerTest a Model Context Protocol server the way an agent does — initialize handshake, protocol version, HTTPS, sign-in discovery and the full tool inventory — and get an A+ to F grade with the exact fix for every problem. Open servers are never marked down for being open.Run the check](/mcp-server-checker)
- [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.Run the check](/ssl-checker)
- [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.Run the check](/ssl-grade-checker)
- [HTTP HeadersInspect response headers, status, redirect chain and security headers.Run the check](/http-header-checker)
- [API TesterSend a real HTTP request from a probe and inspect the response — status, headers and every JSON field.Run the check](/api-tester)
- [Global CDN CheckerAnalyse how a URL is actually delivered worldwide — which CDN serves it, which edge answers in each region, whether it is really being cached, and which regions are behaving differently. Three requests from every probe location, one graded report.Run the check](/cdn-checker)
- [Sitemap CheckerFind and validate a site's XML sitemap — total URL count plus a sample crawl for broken (4xx/5xx) links.Run the check](/sitemap-checker)
- [Brotli CheckerCheck whether a site serves Brotli-compressed responses (Content-Encoding: br) for faster page loads.Run the check](/brotli-checker)
- [Redirect CheckerFollow every redirect a URL goes through — each hop with its status code, Location header and response time, the final destination, and the problems along the way: chains longer than they need to be, loops, a hop back to plain HTTP, or a temporary 302 where a permanent 301 belongs. From a real probe location.Run the check](/redirect-checker)
- [WebSocket TesterOpen a WebSocket connection to any ws:// or wss:// URL from a real probe location — handshake time, the server's remote IP, a ping/pong round-trip, and optionally send a message and check the first message the server sends against a pattern. Test a socket server the way a browser would, without writing a client.Run the check](/websocket-tester)

### Focused web checks

- [SSL Expiry CheckerCheck when a site's SSL certificate expires — days left, the exact not-after date, the issuer and whether the chain is still trusted, from a real TLS handshake. Catch a renewal that silently stopped, a load balancer still serving the old certificate, or a wildcard about to lapse across every subdomain.](/ssl-expiry-checker)
- [TLS Version CheckerSee which TLS versions a server accepts — TLS 1.3, 1.2 and whether the deprecated 1.0, 1.1 and SSL 3.0 are still on — plus the cipher it negotiates, any weak suites it still accepts, and a letter grade for the whole configuration. Prove a legacy protocol is really off before an audit, or find why an old client can't connect.](/tls-version-checker)
- [Security Headers CheckerGrade the HTTP security headers a URL sends, A+ to F — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags — with the reason behind every point lost and the nginx, Apache, Caddy or Cloudflare config that fixes it. The same request a browser makes, from a real probe location.](/security-headers-checker)
- [HSTS CheckerCheck a site's HTTP Strict Transport Security header — whether it is sent at all, its max-age, includeSubDomains and preload directives — and whether the policy meets the requirements for the browser preload list. Find the subdomain that still lets a first visit happen over plain HTTP.](/hsts-checker)
- [HTTP Status CheckerGet the HTTP status code a URL returns right now — 200, 301, 404, 503 — with the response time, redirect count, final URL and headers, fetched from a real probe location rather than your own network. Confirm a page is really down, a redirect is really a 301, or an API is really answering.](/http-status-checker)
- [Sitemap ValidatorValidate a site's XML sitemap — is it where crawlers look, does it parse, how many URLs does it list, and do the sampled ones actually return 200? Catch a sitemap that points at redirected or deleted pages before Search Console reports them as errors.](/sitemap-validator)
- [Gzip Compression TestCheck whether a site serves gzip and Brotli, from a real probe location: the test sends one request offering only gzip and one offering only Brotli, and shows the Content-Encoding the server returned to each. It doesn't measure sizes; the curl commands on this page show the bytes compression saves.](/gzip-test)

## Email 8 tools

- [Email HealthCheck a domain's SPF and DMARC records in one run, with a letter grade. DKIM needs a selector, so it shows as not checked here; use the DKIM Checker for the key.Run the check](/email-policy-checker)
- [SPF CheckerRead a domain's SPF record — its all policy, includes, a second-record check and a count of the DNS lookups the record itself makes (includes are counted, not followed).Run the check](/spf-record-checker)
- [DKIM CheckerCheck the DKIM key published for a selector — the record, key type and key size, and whether the key is live or revoked.Run the check](/dkim-record-checker)
- [DMARC CheckerRead a domain's DMARC record — policy, subdomain policy, pct, alignment modes and whether aggregate and failure reports are requested.Run the check](/dmarc-record-checker)
- [SMTP Server TestConnect to any mail server on port 25, 465 or 587 from a real probe location and see what a sending server sees — the banner, whether STARTTLS is offered, whether reverse DNS matches, and whether it relays for strangers. Verify a new mail host before you route production mail through it.Run the check](/smtp-test)
- [Mail Server CheckerEnter a domain and get an A+ to F grade for every one of its mail servers — inbound MX, SMTP submission, IMAP and POP3. Checks TLS versions and ciphers, certificates, STARTTLS, plain-text logins, open relay, reverse DNS, MTA-STS, TLS-RPT and DANE, from three regions at once, with the exact fix for every problem. No login, no test message sent.Run the check](/mail-server-checker)
- [Email Header AnalyzerPaste raw email headers and see the whole story — the delivery path hop by hop with per-hop delays, SPF/DKIM/DMARC authentication verdicts, From/Return-Path alignment and every header in a searchable table. Runs entirely in your browser: headers contain real addresses and IPs, so nothing is ever uploaded. Free, no signup.Run the check](/email-header-analyzer)
- [SPF & DMARC GeneratorBuild correct SPF and DMARC DNS records in a minute — pick your email providers (Google Workspace, Microsoft 365, SendGrid, SES…), set your policy, and copy ready-to-publish TXT records. Live DNS-lookup counting warns you before you hit SPF's 10-lookup limit. Free, instant, no signup.Run the check](/spf-dmarc-generator)

## Calculators 13 tools

- [Subnet CalculatorWork out any IPv4 network in seconds — enter an address or paste a CIDR and get the network and broadcast addresses, usable host range, subnet and wildcard masks. Advanced mode adds colored binary breakdowns, IP classification (private, public, CGNAT…), the in-addr.arpa name for reverse DNS and a subnet splitter for planning. Free, instant, no signup.Run the check](/subnet-calculator)
- [Uptime CalculatorTurn any SLA percentage into real numbers — see exactly how much downtime 99.9% allows per day, week, month and year, in both directions (uptime and downtime), and estimate what that downtime costs your business based on your revenue. Instant, free, no signup.Run the check](/uptime-calculator)
- [Cron Expression TesterUnderstand any cron expression instantly — get a plain-English explanation, preview the next run times in your timezone, and build schedules from presets. Covers standard 5-field crontab syntax with lists, ranges, steps and @aliases, plus a full syntax cheat sheet. Free, instant, no signup.Run the check](/cron-expression-tester)
- [Timestamp ConverterConvert Unix timestamps to human-readable dates and back — seconds, milliseconds and microseconds auto-detected, shown in UTC, your local timezone and ISO 8601, with a live current-epoch clock and copy buttons everywhere. Free, instant, no signup.Run the check](/unix-timestamp-converter)
- [Error Budget CalculatorSRE-grade error budget math — pick an SLO target and window, enter the downtime you've already burned, and see the remaining budget, burn rate multiplier and projected exhaustion date. Includes fast-burn alert thresholds and a nines reference table. Free, instant, no signup.Run the check](/error-budget-calculator)
- [JSON Formatter & JSONPathFormat, minify and validate JSON with precise error positions, then test JSONPath expressions against your document and see every match. WatchFor API monitor assertions use a simpler dot path (checks.0.name rather than $.checks[0].name), so rewrite brackets and wildcards before pasting a path into one. Runs entirely in your browser; your data never leaves the page. Free, no signup.Run the check](/json-formatter)
- [IPv6 Subnet CalculatorFull 128-bit IPv6 subnet math — compress and expand any address, get the network prefix, first and last addresses, exact address counts, ip6.arpa reverse DNS and address type classification (GUA, ULA, link-local…), plus prefix planning: how many /64s fit in your /48. Free, instant, no signup.Run the check](/ipv6-subnet-calculator)
- [Bandwidth CalculatorHow long will that transfer take? Convert file sizes and connection speeds into real download times (with protocol overhead accounted for), or work backwards from a deadline to the bandwidth you need. Clears up Mbps vs MB/s once and for all. Free, instant, no signup.Run the check](/bandwidth-calculator)
- [Chmod CalculatorUnix file permissions without the head-scratching — flip the rwx checkboxes and get the octal number, symbolic notation and ready-to-run chmod command, or type 755 and see exactly what it grants. Covers setuid, setgid and the sticky bit, with presets for the permissions you actually use. Free, no signup.Run the check](/chmod-calculator)

### More calculators

- [Crontab GeneratorBuild a crontab line without memorising the field order — pick a schedule from presets or type one, read it back in plain English, and preview the next run times in your timezone before you paste it into crontab -e. Covers lists, ranges, steps and @daily-style aliases. Free, instant, no signup.](/crontab-generator)
- [Epoch ConverterConvert epoch time to a human date and back — seconds, milliseconds and microseconds detected automatically, shown in UTC, your local timezone and ISO 8601, with the current epoch ticking live. Decode the timestamp in a log line or a JWT, or get the epoch for a date. Free, instant, no signup.](/epoch-converter)
- [CIDR CalculatorTurn CIDR notation into what it actually covers — network and broadcast address, first and last usable host, subnet and wildcard mask, host count — and split a block into smaller prefixes for planning. Paste 10.0.0.0/22 and see the whole picture. Free, instant, no signup.](/cidr-calculator)
- [SLA CalculatorTranslate an SLA into numbers you can hold a vendor to — how much downtime 99.9%, 99.95% or 99.99% actually permits per day, week, month and year, in both directions, and what that downtime costs at your revenue. Compare tiers before you sign, or check whether last month's outage breached the agreement. Free, instant, no signup.](/sla-calculator)

## Why these instead of MXToolbox or dig?

Free diagnostics aren't new — MXToolbox, dnschecker.org and dig have covered this for years. Here's where ours are different:

- · Real infrastructure. Every check runs from the same global prober fleet that powers our paid monitoring — not a single VPS that throttles after a few hundred requests. Geographic spread and headroom included.
- · Honest results. No upgrade-to-see-more gates, no ad clutter, no fake-warning upsells. You get the exact same output our paying customers see — just without saved history and always-on monitoring.
- · One click to keep watching. If a check finds a problem, turn on 24/7 monitoring for it right from the result — same tool, same infrastructure, no copy-pasting into a second product.

Prefer the terminal? dig , mtr and openssl still win for scripting and exact protocol control. These shine when you want to share a result, check from another location, or skip remembering the flags.

## How the tools work

Every tool runs the same probe under the hood. You click Run, we rate-limit the request by IP, hand it to our global prober fleet to do the real protocol-level check (DNS query, TCP handshake, ICMP echo, TLS, HTTP…), and render the result. Probes are written in Go, run with sane 5–10s timeouts, and return their native output — not a reformatted-for-marketing summary.

A few things we deliberately don't do:

- · We don't keep your results or secrets. A short security record of each run (IP, tool, target, time) is kept for misuse investigations and deleted after 12 months.
- · We don't run from your browser. The check happens on our servers, so the result is free of your ISP, firewall, VPN or extensions. For the browser view, use DevTools.
- · We don't oversell one check. A single run is one moment from one place — intermittent or regional issues won't always show. If it matters, monitor it continuously.

## Run this check on every change, not just once.

Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card.

[Start free](/auth/sign-up)

## Frequently asked questions

Are these tools really free, or is there a hidden catch? Free, no signup, no credit card. We rate-limit per IP (30 requests/hour shared across tools, 10/hour for DNS Propagation since it fans out to every region at once) to keep abuse manageable — that's the only constraint. The free tools run on the same prober infrastructure that paying WatchFor customers use for continuous monitoring; the difference between free and paid is volume and continuity, not feature gating.

How are these different from MXToolbox, dnschecker.org, or dig from the terminal? Same underlying protocols, different scope and quality. We run from real production prober regions (not from your browser, not from a single VPS). Output is consistent across tools (same result panel components used in the paid product, no ads, no upsells in the result itself). And every check is one click away from continuous 24/7 monitoring if the answer matters beyond the current incident. Terminal dig and mtr give you the same data — these tools win when you want to share the result with a colleague or run from a different geographic vantage.

Do you log my queries? We keep a short security record of each run — caller IP, tool, target and timestamp — so that misuse of the tools can be investigated, and it is deleted automatically after 12 months. We do not store credentials : where a tool accepts request headers, secret values like Authorization , cookies and API keys are stripped before anything is written, and request bodies are never saved. We don't sell or share query data, and the results themselves aren't retained — once we send you the output, it is gone.

Can I check my private internal hostname? No — we run from public infrastructure on the public internet. Private DNS names ( *.internal , *.local , RFC1918 IPs) are blocked at the input layer. If you need to verify private/internal connectivity, Enterprise plans can add private locations that run inside your own network.

Why is one tool rate-limited harder than the others? Each tool has its own per-hour cap, set by what one run costs. DNS Propagation fans out to every probe location at once, the Global CDN Checker sends requests from every location, and the Core Web Vitals Checker runs a real browser with Lighthouse, so those have the tightest caps. A combined cap across all tools applies on top. When you reach a limit, the tool says which one and when it resets.

What's the difference between the free tool and the same check inside the paid product? The probe is identical — same code, same regions, same answer. The paid product adds continuity (the check runs every minute, not once when you click), alerting (you get notified when results change), history (look at how the answer has drifted over weeks), team access, status pages, and the rest of the 30 monitor types. Free tools are the diagnostic; paid is the always-on version.

Can I embed these tools in my own site or share results with a link? Sharable result links are on the roadmap — each successful check will produce a permanent URL that anyone can open without re-running. Embed widgets aren't planned in the short term but a public REST API for the most common tools is being evaluated. Open a request if you want a specific tool API.

What if I need higher rate limits for legitimate use? Sign up free — authenticated users on any plan get higher per-user limits and access to the in-app toolbox with persistent history. If you're integrating these into your own product or doing security research, contact us with a use case and we'll work out something sensible.

---

Canonical page: https://watchfor.io/free-tools · Site guide: https://watchfor.io/llms.txt