# MtrXTools

> Free network diagnostics: DNS, SSL/TLS, HTTP headers, SPF/DKIM/DMARC, RDAP/WHOIS, IP and cloud ownership, ports, ping and NTP, plus an explainer for about 280 common error messages. No account needed; results are not stored.

Every check runs live against the target, so results reflect the current state of a domain or server. Tool pages accept the input in the URL, e.g. https://www.mtrxtools.com/dns-lookup?q=example.com&type=MX, and the same checks are available as a free JSON API.

## Tools

- [DNS lookup](https://www.mtrxtools.com/dns-lookup): Look up A, AAAA, MX, TXT, NS, SOA, CAA and DNSSEC records from Cloudflare, Google, Quad9 or the authoritative servers, with TTLs and flags. Free.
- [Reverse DNS](https://www.mtrxtools.com/reverse-dns): Find the hostname behind an IPv4 or IPv6 address (PTR record) and check that it resolves back to the same IP: forward-confirmed reverse DNS. Free.
- [DNS propagation](https://www.mtrxtools.com/dns-propagation): Check DNS propagation across 22 resolvers on five continents: see which still cache the old record and when each copy expires.
- [DNS health report](https://www.mtrxtools.com/dns-report): A graded DNS health report: parent and zone nameservers, lame delegation, glue, SOA serials and timers, open recursion and the DNSSEC chain.
- [SSL/TLS checker](https://www.mtrxtools.com/ssl-checker): Check a site's SSL/TLS certificate: expiry, hostname match, chain of trust, key strength and TLS 1.0 to 1.3 support, graded A+ to F with fixes.
- [Certificate Transparency search](https://www.mtrxtools.com/ct-search): Search CT logs for every certificate issued for a domain and its subdomains, check issuers against CAA and find names about to expire.
- [OCSP / revocation check](https://www.mtrxtools.com/revocation-check): Check if a site's TLS certificate is revoked: stapled OCSP, the CA's OCSP responder and its CRL, with signatures, freshness and Must-Staple.
- [HTTP headers](https://www.mtrxtools.com/http-headers): See every redirect and the raw HTTP response headers for any URL, and grade security headers: HSTS, CSP, X-Frame-Options, Referrer-Policy and more.
- [CSP evaluator](https://www.mtrxtools.com/csp-evaluator): Check a site's Content-Security-Policy or a pasted policy: unsafe-inline, wildcards, bypassable allowlists, reused nonces and syntax mistakes.
- [Cookie inspector](https://www.mtrxtools.com/cookie-inspector): Check every cookie a site sets: Secure, HttpOnly, SameSite, __Host- prefixes, lifetime, and mistakes that make browsers silently drop a cookie.
- [CORS tester](https://www.mtrxtools.com/cors-tester): Test CORS from any origin: the preflight, Access-Control-Allow-Origin, methods, headers and credentials, and why a browser blocks the request.
- [HSTS preload checker](https://www.mtrxtools.com/hsts-preload): Check whether a domain meets every HSTS preload list requirement (redirects, header, www) and see its current status on hstspreload.org.
- [security.txt validator](https://www.mtrxtools.com/security-txt): Validate a site's security.txt: location, Contact, Expires, HTTPS addresses, Canonical and signature, with a corrected RFC 9116 file to copy.
- [Website health](https://www.mtrxtools.com/website-health): A graded website health report: DNS, every server IP tested on its own, http/https and www redirects, TLS renewal risk, HSTS and domain expiry.
- [Expiry calendar](https://www.mtrxtools.com/expiry-calendar): Calendar reminders before SSL certificates, domains and security.txt expire. Subscribe in Google Calendar, Outlook or Apple Calendar.
- [Status badges](https://www.mtrxtools.com/status-badges): Free SVG badges for READMEs and status pages: certificate expiry, TLS grade, security headers, DMARC policy and IPv6 support, updated automatically.
- [SPF, DKIM & DMARC](https://www.mtrxtools.com/email-auth): Check a domain's SPF record and lookup count, find DKIM keys, read the DMARC policy, and see MTA-STS, TLS-RPT and BIMI, with a grade and fixes.
- [SPF & DMARC record builder](https://www.mtrxtools.com/spf-dmarc-builder): Build SPF and DMARC records with a live DNS lookup count, import your current records and copy the TXT record or zone-file line. Free.
- [Email header analyser](https://www.mtrxtools.com/email-headers): Paste raw email headers to see each hop and its delay, SPF, DKIM and DMARC results and spoofing red flags. Runs in your browser, never uploaded.
- [DMARC report analyser](https://www.mtrxtools.com/dmarc-reports): Upload DMARC aggregate reports (.xml, .gz, .zip) to see who sends as your domain, which senders fail SPF or DKIM, and when to move to p=reject.
- [MTA-STS & TLS-RPT](https://www.mtrxtools.com/mta-sts): Check a domain's MTA-STS record and policy file, whether every MX host is covered before you enforce, and its TLS-RPT reporting record. Free.
- [BIMI checker](https://www.mtrxtools.com/bimi): Check if inboxes will show your logo: the BIMI record, SVG Tiny PS logo, Verified or Common Mark Certificate and DMARC, with a preview.
- [Blocklist check](https://www.mtrxtools.com/blocklists): Check an IP address or domain against Spamhaus, SpamCop, Barracuda, SURBL, URIBL and other spam blocklists, with the reason and how to delist.
- [RPKI validity](https://www.mtrxtools.com/rpki): Check if a prefix, IP address or AS is RPKI valid, invalid or not found, see the ROAs that decide it, and spot maxLength that invites hijacks.
- [ASN & prefix explorer](https://www.mtrxtools.com/asn-explorer): Look up an AS number or prefix: announced routes, upstreams, AS paths, visibility, IRR route objects and origin history, from RIPE's collectors.
- [RDAP lookup](https://www.mtrxtools.com/rdap): Look up domain, IP range or ASN registration data over RDAP, the modern WHOIS: registrar, dates, status, nameservers and abuse contacts.
- [WHOIS](https://www.mtrxtools.com/whois): Query WHOIS servers directly for any domain or IP, following referrals from IANA to the registry and registrar, and see every raw response. Free.
- [IP info](https://www.mtrxtools.com/ip-info): Look up any IP address or hostname: approximate location, network owner and ASN, address type (public, private, CGNAT) and reverse DNS. Free.
- [Cloud IP owner](https://www.mtrxtools.com/cloud-ip): Is this IP AWS, Azure, Google Cloud, Cloudflare, Fastly, Oracle or DigitalOcean? See the service and region, and verify Googlebot or Bingbot.
- [What's my IP](https://www.mtrxtools.com/my-ip): See your public IPv4 and IPv6 address, your network provider and approximate location as websites see them. Free, instant, no sign-up.
- [Ping (TCP)](https://www.mtrxtools.com/ping): Measure latency to any host by timing TCP handshakes on port 443 or any port: min, average, max, jitter and loss. Works where ICMP ping is blocked.
- [Port check](https://www.mtrxtools.com/port-check): Check if TCP ports are open, closed or filtered on any host, with presets for web, mail, remote access and databases, connect times and banners.
- [NTP test](https://www.mtrxtools.com/ntp-test): Query an NTP time server over UDP 123 and see its clock offset, round-trip delay, stratum, reference source, leap status and root distance. Free.
- [Subnet calculator](https://www.mtrxtools.com/subnet-calculator): Calculate network and broadcast addresses, usable host range, netmask and subnet splits for any IPv4 or IPv6 CIDR block. Runs in your browser.
- [Network planner](https://www.mtrxtools.com/network-planner): Summarise CIDR blocks into the fewest prefixes, find the range holding an IP, convert netmasks to wildcard masks with ACL snippets, plan IPv6.
- [IPv6 tools](https://www.mtrxtools.com/ipv6-tools): Expand or compress an IPv6 address, see its type, decode Teredo, 6to4 and NAT64, convert EUI-64 to a MAC and back, and get the ip6.arpa zone.
- [MAC vendor lookup](https://www.mtrxtools.com/mac-lookup): Find the manufacturer of a MAC address from the IEEE OUI registry, see if it is randomised or multicast, and convert it between formats. Free.
- [Certificate decoder](https://www.mtrxtools.com/certificate-decoder): Decode a PEM certificate, chain or CSR in your browser: subject, issuer, dates, SANs, key, extensions, fingerprints, chain order and signatures.
- [Key & CSR generator](https://www.mtrxtools.com/csr-generator): Generate an RSA or ECDSA key and CSR for any domains, wildcards and IPs, or a self-signed certificate, in your browser. OpenSSL command included.
- [SSL converter](https://www.mtrxtools.com/ssl-converter): Convert certificates and keys between PEM and DER or PKCS#1 and PKCS#8, remove a passphrase, extract P7B certificates and check a key matches.
- [PFX converter](https://www.mtrxtools.com/pfx-converter): Extract the certificate, chain and private key from a PFX or P12 file as PEM, or create a PFX from PEM for IIS and Azure. Runs in your browser.
- [TLSA & SSHFP generator](https://www.mtrxtools.com/tlsa-generator): Generate DANE TLSA records (3 1 1, 2 1 1) from a certificate, chain or public key for SMTP or HTTPS, and SSHFP records from SSH host keys, in your browser.
- [Error explainer](https://www.mtrxtools.com/error-explainer): Paste an error from a browser, curl, Python, Java, Go, git, SSH, Docker, nginx, Cloudflare or an email bounce: see what it means and how to fix it.
- [JSON formatter](https://www.mtrxtools.com/json-formatter): Format, validate and minify JSON in your browser. See the exact line and cause of any error, repair trailing commas and comments, and sort keys.
- [JWT decoder](https://www.mtrxtools.com/jwt-decoder): Decode a JWT's header and claims, see when it expires, spot alg none and other risks, and verify HS, RS, ES or EdDSA signatures in your browser.
- [SAML decoder](https://www.mtrxtools.com/saml-decoder): Decode a SAMLResponse or SAMLRequest from a redirect URL or form post, pretty-print the XML, and check status, NameID, attributes, expiry and signatures.
- [Base64 / Base32 / Base58](https://www.mtrxtools.com/base64): Decode and encode base64, base64url, data: URIs, base32, Base58 and Ascii85 in your browser, with files recognised and Base58Check checksums verified.
- [URL encode / decode](https://www.mtrxtools.com/url-encoder): Percent-encode and decode URLs and query values, spot double encoding, split a URL into parameters, and convert international domains.
- [Punycode / IDN converter](https://www.mtrxtools.com/idn-converter): Convert international domain names to and from punycode (xn--), check them against IDNA 2008 rules, and spot lookalike domains such as аррӏе.com.
- [Hex converter](https://www.mtrxtools.com/hex-converter): Convert hex to text and back, plus binary, decimal bytes and base64. Accepts 0x, \x, colons and spaces, shows a hex dump and integer values.
- [HTML entity encode / decode](https://www.mtrxtools.com/html-entities): Escape text for HTML and decode named, decimal and hex entities the way browsers do, with double encoding spotted and every character's code point shown.
- [MIME decoder](https://www.mtrxtools.com/mime-decoder): Decode MIME encoded-words in email subjects and names, RFC 2231 filenames and quoted-printable bodies in any charset, or encode text the same way.
- [Gzip / deflate decoder](https://www.mtrxtools.com/gzip-decompress): Decompress gzip, zlib or raw deflate data pasted as base64 or hex, or from a file, with the format detected. Compress text or files the same way.
- [Unix timestamp converter](https://www.mtrxtools.com/timestamp-converter): Convert Unix epoch time in seconds, ms, µs or ns to UTC, local and ISO 8601 dates and back. Reads HTTP dates, X.509 times and Windows FILETIME.
- [Hash generator](https://www.mtrxtools.com/hash-generator): Hash text or a file with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, check a checksum, and compute or verify HMAC webhook signatures in your browser.
- [SRI hash generator](https://www.mtrxtools.com/sri-generator): Create Subresource Integrity hashes (sha256, sha384, sha512) for a script or stylesheet with ready-made tags, and check an integrity attribute against a file.

## API

Free, keyless JSON API. GET with query parameters; responses are {"ok": true, "ms": ..., "data": {...}} or {"ok": false, "error": "..."}. Rate limited per IP.

- [API documentation](https://www.mtrxtools.com/developers)
- [OpenAPI 3.1 description](https://www.mtrxtools.com/api/v1/openapi.json)
- MCP server (Streamable HTTP, no key): https://www.mtrxtools.com/api/mcp exposes the same checks as read-only tools for AI assistants and agents. Setup: https://www.mtrxtools.com/developers#mcp

- [DNS lookup](https://www.mtrxtools.com/api/v1/dns-lookup): Query DNS records from a public resolver or straight from the domain's authoritative nameservers, with TTLs and flags.
- [Reverse DNS](https://www.mtrxtools.com/api/v1/reverse-dns): Find the PTR hostname for an IPv4 or IPv6 address and check that it resolves back to the same address.
- [DNS health report](https://www.mtrxtools.com/api/v1/dns-report): A graded report on how a zone is delegated and served: the parent's NS set, glue and DS against the zone's own, every nameserver asked directly (authoritative answer, SOA serial, TCP, open recursion, network and AS), SOA timers, MX and CAA sanity, and the DNSSEC chain from DS to DNSKEY with signature expiry.
- [DNS propagation](https://www.mtrxtools.com/api/v1/dns-propagation): Ask 22 resolvers on five continents and the zone's own nameservers, group the answers, and return when each stale cached copy expires, plus the parent zone's delegation.
- [SSL/TLS checker](https://www.mtrxtools.com/api/v1/ssl-checker): Read the certificate chain a server sends, check expiry, hostname match, trust and key, test TLS 1.0 to 1.3, and grade it.
- [HTTP headers](https://www.mtrxtools.com/api/v1/http-headers): Follow every redirect, return each hop's status, headers and timing, and grade the security headers of the final page.
- [CSP evaluator](https://www.mtrxtools.com/api/v1/csp-evaluator): Evaluate the Content-Security-Policy of a URL (headers, report-only and <meta> policies, with the page fetched twice to check nonces change) or of a policy passed directly. Returns each policy parsed into directives and sources with risk notes, checks for inline scripts, wildcards, bypassable allowlists, plugins, base-uri, framing, reporting and syntax mistakes, and an overall verdict.
- [Cookie inspector](https://www.mtrxtools.com/api/v1/cookie-inspector): Collect every Set-Cookie header along a URL's redirect chain, or check Set-Cookie headers passed directly (one per line). Returns each cookie's parsed attributes, lifetime, the response that set it, a label for well-known cookies, and checks for rules that make browsers refuse it (SameSite=None or Partitioned without Secure, __Host- and __Secure- prefixes, Domain, size) and for weaknesses (missing Secure, HttpOnly or SameSite, long lifetimes, broad Domain), plus a summary.
- [CORS tester](https://www.mtrxtools.com/api/v1/cors-tester): Send the CORS preflight a browser would send for a cross-origin request from the given origin (when one is needed), then a GET with that Origin, and check both responses the way the browser does: Access-Control-Allow-Origin, -Methods, -Headers, -Credentials, -Max-Age, Vary and exposed headers. Requests that could change data are never sent; only their preflight is. Returns each exchange's headers and checks, an allowed or blocked verdict and equivalent curl commands.
- [OCSP / revocation check](https://www.mtrxtools.com/api/v1/revocation-check): Check whether the certificate a server presents has been revoked: the stapled OCSP response, a query to the CA's OCSP responder and a download of its CRL (up to 10 MB), each with status, this and next update, timings and signature verification against the issuer, plus Must-Staple and an overall verdict (good, revoked or unknown).
- [security.txt validator](https://www.mtrxtools.com/api/v1/security-txt): Find a domain's security.txt (/.well-known/security.txt, or the legacy /security.txt), following redirects, and validate it against RFC 9116: Content-Type, the required Contact and Expires fields, HTTPS addresses, Canonical, Encryption, Preferred-Languages, OpenPGP signing, unknown fields and stray lines. Returns the parsed fields, the file, checks and a corrected file.
- [Certificate Transparency search](https://www.mtrxtools.com/api/v1/ct-search): List the unexpired certificates logged in Certificate Transparency for a domain and its subdomains (from SSLMate Cert Spotter, with crt.sh as a fallback; cached for 30 minutes). Returns each certificate's names, issuer, validity and revocation, the issuers checked against the domain's CAA records, every host name found with its latest expiry, and checks for unauthorised issuers and names expiring with no replacement.
- [HSTS preload checker](https://www.mtrxtools.com/api/v1/hsts-preload): Check each hstspreload.org requirement for a domain (trusted certificate, HTTP redirecting to HTTPS on the same host, one Strict-Transport-Security header with max-age of at least a year, includeSubDomains and preload, HTTPS on www), with the redirect hops, the domain's preload list status and hstspreload.org's own errors and warnings.
- [Website health](https://www.mtrxtools.com/api/v1/website-health): A graded site report: DNS, every A/AAAA address, the http/https and www/apex redirect matrix, TLS, accepted cipher suites, headers, domain expiry and content basics.
- [SPF, DKIM & DMARC](https://www.mtrxtools.com/api/v1/email-auth): Check SPF (with the DNS lookup count), find DKIM keys, read the DMARC policy, MTA-STS, TLS-RPT and BIMI, and grade the setup.
- [MTA-STS & TLS-RPT](https://www.mtrxtools.com/api/v1/mta-sts): Check the _mta-sts record, fetch and validate the policy file (certificate, redirects, content type, syntax), match its mx patterns against the domain's MX hosts, and read the TLS-RPT record and its report destinations.
- [BIMI checker](https://www.mtrxtools.com/api/v1/bimi): Check the BIMI record (at the domain or its organisational domain), fetch the logo and check it against the SVG Tiny PS profile, fetch and verify the mark certificate (BIMI usage, domain, expiry, chain, mark type, whether its embedded logo matches), and confirm DMARC enforcement. Includes the logo as a data: URI.
- [Blocklist check](https://www.mtrxtools.com/api/v1/blocklists): Check an IP address against 13 DNS blocklists, or a domain against 3 domain blocklists plus its mail servers' and website's addresses against the IP lists. Each result is listed, clean, or not verified when a list doesn't confirm its own test entry.
- [RPKI validity](https://www.mtrxtools.com/api/v1/rpki): RPKI route origin validation (valid, invalid_asn, invalid_length or unknown) for the routes covering an IP address or a domain's addresses, a prefix, or every prefix an AS announces, with the deciding ROAs, RIS visibility, and ROAs whose maxLength is longer than announced. Data from RIPEstat.
- [ASN & prefix explorer](https://www.mtrxtools.com/api/v1/asn-explorer): What the global routing table says about an AS number or a prefix (or the route covering an IP address or domain), from RIPEstat. For an AS: holder and registry, announced IPv4 and IPv6 prefixes, upstream and downstream neighbours with names, and prefixes missing from the IRR. For a prefix: origins with their IRR route objects, visibility across RIS peers, upstreams and sample AS paths from collectors worldwide, covering and more-specific routes, a week of update activity and the origin history. With checks for single upstreams, missing IRR objects, multiple origins, foreign more-specifics, over-specific prefixes and flapping.
- [RDAP lookup](https://www.mtrxtools.com/api/v1/rdap): Registration data over RDAP: registrar, dates, status, nameservers and abuse contacts for a domain, IP address or range, or AS number.
- [WHOIS](https://www.mtrxtools.com/api/v1/whois): Query WHOIS servers directly, following referrals from IANA to the registry and registrar, and return each raw response.
- [IP info](https://www.mtrxtools.com/api/v1/ip-info): Network, AS number, approximate location, address type and reverse DNS for an IP address. Hostnames are resolved first.
- [Cloud IP owner](https://www.mtrxtools.com/api/v1/cloud-ip): Which cloud, CDN or crawler owns an address, from each provider's published ranges, with service and region. Verifies Googlebot and Bingbot.
- [What's my IP](https://www.mtrxtools.com/api/v1/my-ip): The public IP address the request came from, with its network and approximate location. For scripts, /api/v1/my-ip/ipv4, /api/v1/my-ip/ipv6 and /api/v1/my-ip/ip return just the address as plain text (add ?format=json for {"ip": "..."}). A server sees only the family a request arrives over, so /ipv4 and /ipv6 answer 422 with a hint when the connection used the other one; force it with curl -4 or curl -6.
- [Port check](https://www.mtrxtools.com/api/v1/port-check): Whether TCP ports are open, closed or filtered, with connect times and the banner a service sends first. Up to 20 ports.
- [Ping (TCP)](https://www.mtrxtools.com/api/v1/ping): Round-trip time to a host from timed TCP handshakes: min, average, max, jitter and loss. Works where ICMP is blocked.
- [NTP test](https://www.mtrxtools.com/api/v1/ntp-test): Query an NTP server over UDP 123: clock offset, delay, stratum, reference, leap status and root distance, over several samples.
- [Error explainer](https://www.mtrxtools.com/api/v1/explain-error): Match an error message or log line against MtrXTools's error library: what it means, causes, fixes, and the check that confirms it.

## Errors

- [Error explainer](https://www.mtrxtools.com/error-explainer): paste an error message to get its meaning, causes, fixes and the check that confirms it. Each known error also has a page at https://www.mtrxtools.com/errors/<slug>.