Free tool · No sign-up required
DNS Inspector —
every DNS record, interpreted.
Enter any domain and get its full DNS footprint — A, MX, NS, TXT, and CAA records — plus interpreted SPF and DMARC security verdicts, not just raw output.
DNS hosts & mail providers detected
What it shows you
Full DNS record lookup
One scan queries A, AAAA, CNAME, MX, NS, TXT, SOA, and CAA in parallel via DNS-over-HTTPS. No dig, no terminal, no per-record-type lookups.
SPF security posture
Parses the SPF record's mechanisms and the final qualifier — flags a strict -all, a softfail ~all, or a wide-open +all that any server can spoof from.
DMARC policy verdict
Reads the _dmarc TXT record and gives a plain-English verdict — Protected (quarantine/reject), Monitoring only (p=none), or Unprotected (no record at all).
CAA authority check
Decodes CAA records (including the raw RFC 3597 wire format most tools show as unreadable hex) and flags domains with no CAA record at all — meaning any certificate authority can issue for them.
DNS host & mail provider ID
Guesses the DNS host from NS records (Cloudflare, Route 53, GoDaddy, Namecheap, and more) and the mail provider from MX records (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast).
Raw JSON download
Download the full parsed record set — every record type, SPF/DMARC verdicts, and provider guesses — as a single JSON file for audits and documentation. Pro feature.
Record types queried in parallel
Who uses it
Security engineers
Audit email spoofing protection (SPF/DMARC) and certificate mis-issuance exposure (CAA) across every domain your org owns, before an attacker checks first.
Email deliverability & DevOps teams
Confirm SPF, DMARC, and MX records are correct before a mail migration or a new ESP goes live — the single most common cause of emails landing in spam.
Platform and infrastructure teams
Identify which DNS host and mail provider a newly acquired or unfamiliar domain actually runs on, without shelling out to dig or nslookup.