MtrXTools API

Query DNS records from a public resolver or straight from the domain's authoritative nameservers, with TTLs and flags.

Find the PTR hostname for an IPv4 or IPv6 address and check that it resolves back to the same address.

A graded report on how a zone is delegated and served: the parent's NS set, glue and DS against the zone's own, every nameserver asked directly (authoritative answer, SOA serial, TCP, open recursion, network and AS), SOA timers, MX and CAA sanity, and the DNSSEC chain from DS to DNSKEY with signature expiry.

Ask 22 resolvers on five continents and the zone's own nameservers, group the answers, and return when each stale cached copy expires, plus the parent zone's delegation.

Read the certificate chain a server sends, check expiry, hostname match, trust and key, test TLS 1.0 to 1.3, and grade it.

Follow every redirect, return each hop's status, headers and timing, and grade the security headers of the final page.

Evaluate the Content-Security-Policy of a URL (headers, report-only and <meta> policies, with the page fetched twice to check nonces change) or of a policy passed directly. Returns each policy parsed into directives and sources with risk notes, checks for inline scripts, wildcards, bypassable allowlists, plugins, base-uri, framing, reporting and syntax mistakes, and an overall verdict.

Collect every Set-Cookie header along a URL's redirect chain, or check Set-Cookie headers passed directly (one per line). Returns each cookie's parsed attributes, lifetime, the response that set it, a label for well-known cookies, and checks for rules that make browsers refuse it (SameSite=None or Partitioned without Secure, __Host- and __Secure- prefixes, Domain, size) and for weaknesses (missing Secure, HttpOnly or SameSite, long lifetimes, broad Domain), plus a summary.

Send the CORS preflight a browser would send for a cross-origin request from the given origin (when one is needed), then a GET with that Origin, and check both responses the way the browser does: Access-Control-Allow-Origin, -Methods, -Headers, -Credentials, -Max-Age, Vary and exposed headers. Requests that could change data are never sent; only their preflight is. Returns each exchange's headers and checks, an allowed or blocked verdict and equivalent curl commands.

Check whether the certificate a server presents has been revoked: the stapled OCSP response, a query to the CA's OCSP responder and a download of its CRL (up to 10 MB), each with status, this and next update, timings and signature verification against the issuer, plus Must-Staple and an overall verdict (good, revoked or unknown).

Find a domain's security.txt (/.well-known/security.txt, or the legacy /security.txt), following redirects, and validate it against RFC 9116: Content-Type, the required Contact and Expires fields, HTTPS addresses, Canonical, Encryption, Preferred-Languages, OpenPGP signing, unknown fields and stray lines. Returns the parsed fields, the file, checks and a corrected file.

List the unexpired certificates logged in Certificate Transparency for a domain and its subdomains (from SSLMate Cert Spotter, with crt.sh as a fallback; cached for 30 minutes). Returns each certificate's names, issuer, validity and revocation, the issuers checked against the domain's CAA records, every host name found with its latest expiry, and checks for unauthorised issuers and names expiring with no replacement.

Check each hstspreload.org requirement for a domain (trusted certificate, HTTP redirecting to HTTPS on the same host, one Strict-Transport-Security header with max-age of at least a year, includeSubDomains and preload, HTTPS on www), with the redirect hops, the domain's preload list status and hstspreload.org's own errors and warnings.

A graded site report: DNS, every A/AAAA address, the http/https and www/apex redirect matrix, TLS, accepted cipher suites, headers, domain expiry and content basics.

Check SPF (with the DNS lookup count), find DKIM keys, read the DMARC policy, MTA-STS, TLS-RPT and BIMI, and grade the setup.

Check the _mta-sts record, fetch and validate the policy file (certificate, redirects, content type, syntax), match its mx patterns against the domain's MX hosts, and read the TLS-RPT record and its report destinations.

Check the BIMI record (at the domain or its organisational domain), fetch the logo and check it against the SVG Tiny PS profile, fetch and verify the mark certificate (BIMI usage, domain, expiry, chain, mark type, whether its embedded logo matches), and confirm DMARC enforcement. Includes the logo as a data: URI.

Check an IP address against 13 DNS blocklists, or a domain against 3 domain blocklists plus its mail servers' and website's addresses against the IP lists. Each result is listed, clean, or not verified when a list doesn't confirm its own test entry.

RPKI route origin validation (valid, invalid_asn, invalid_length or unknown) for the routes covering an IP address or a domain's addresses, a prefix, or every prefix an AS announces, with the deciding ROAs, RIS visibility, and ROAs whose maxLength is longer than announced. Data from RIPEstat.

What the global routing table says about an AS number or a prefix (or the route covering an IP address or domain), from RIPEstat. For an AS: holder and registry, announced IPv4 and IPv6 prefixes, upstream and downstream neighbours with names, and prefixes missing from the IRR. For a prefix: origins with their IRR route objects, visibility across RIS peers, upstreams and sample AS paths from collectors worldwide, covering and more-specific routes, a week of update activity and the origin history. With checks for single upstreams, missing IRR objects, multiple origins, foreign more-specifics, over-specific prefixes and flapping.

Registration data over RDAP: registrar, dates, status, nameservers and abuse contacts for a domain, IP address or range, or AS number.

Query WHOIS servers directly, following referrals from IANA to the registry and registrar, and return each raw response.

Network, AS number, approximate location, address type and reverse DNS for an IP address. Hostnames are resolved first.

Which cloud, CDN or crawler owns an address, from each provider's published ranges, with service and region. Verifies Googlebot and Bingbot.

The public IP address the request came from, with its network and approximate location. For scripts, /api/v1/my-ip/ipv4, /api/v1/my-ip/ipv6 and /api/v1/my-ip/ip return just the address as plain text (add ?format=json for {"ip": "..."}). A server sees only the family a request arrives over, so /ipv4 and /ipv6 answer 422 with a hint when the connection used the other one; force it with curl -4 or curl -6.

Whether TCP ports are open, closed or filtered, with connect times and the banner a service sends first. Up to 20 ports.

Round-trip time to a host from timed TCP handshakes: min, average, max, jitter and loss. Works where ICMP is blocked.

Query an NTP server over UDP 123: clock offset, delay, stratum, reference, leap status and root distance, over several samples.

Match an error message or log line against MtrXTools's error library: what it means, causes, fixes, and the check that confirms it.