# NetTools > Stateless network and DNS diagnostic tools. Every tool runs entirely from URL > query parameters and returns either HTML or JSON, so results are reproducible > and shareable by URL alone. ## For automated clients Append `format=json` to any tool URL for structured output. No API key, no authentication, no session, no cookies. A GET request is the whole contract. Response shape: ```json { "tool": { "id": "...", "title": "...", "category": "...", "description": "..." }, "input": { "...validated inputs..." }, "result": { "status": "ok" | "error", "summary": "one-line human summary", "details": { }, "timings": { }, "warnings": [ ] | null }, "cache": { "hit": false, "ttl_s": 60 } } ``` HTTP 200 when `status` is `ok`, 400 when `error`, 404 for an unknown tool, 429 when rate limited (with `Retry-After`). Discover the full tool list at `/?format=json`. ## Tools - [Reverse DNS Lookup](/t/reverse-dns): `?ip=8.8.8.8` - PTR record for an IP, forward-confirmed (FCrDNS): the hostname is resolved back and checked against the original address. Handles IPv4 (`in-addr.arpa`) and IPv6 (`ip6.arpa`). - [NS Lookup](/t/ns-lookup): `?domain=example.com` - nameservers with their addresses, plus each one queried directly for the zone SOA so out-of-sync secondaries are visible. Serials are compared only within a DNS provider, never across providers, since each provider numbers its own zone. - [MX Lookup](/t/mx-lookup): `?domain=example.com` - mail exchangers in priority order with resolved addresses, detecting null MX (RFC 7505), missing MX, MX pointing at a CNAME (RFC 2181 violation), and MX hosts that do not resolve. - [Domain to IP Lookup](/t/domain-to-ip): `?domain=example.com` - A and AAAA records annotated with hosting location, ASN and network owner. - [Public DNS Servers](/t/dns-servers): `?country=DE` - verified public resolvers by country. Every entry answered a control query when the list was built; anycast operators are marked and carry no location claim. - [Domain WHOIS Lookup](/t/domain-whois): `?domain=example.com` - RDAP registration data: registrar, registered/updated/expiry dates, nameservers, and EPP status codes explained in plain language. Flags expiry within 30 days and statuses that stop a domain resolving (clientHold, redemption period). - [ASN WHOIS Lookup](/t/asn-whois): `?asn=AS15169` - accepts an AS number, a bare number, or an IP address (ASN resolved locally via GeoIP first). Returns organisation, country, allocation block and abuse contact. - [Domain DNS Health Checker](/t/domain-health): `?domain=example.com` - graded report over nameservers, provider diversity, SOA timers, address records, IPv6, MX, SPF, DMARC, DNSSEC, CAA and registration. Each check returns pass/warn/fail, or **unknown** when it could not be performed. Unknown checks are excluded from the grade and never counted as passes. When a broken DNSSEC chain makes a validating resolver return SERVFAIL for the whole zone, the dependent checks report unknown and point at the DNSSEC check rather than reporting a pile of unrelated failures. - [DNS Propagation Checker](/t/dns-propagation): `?domain=example.com&type=A` - queries ~42 public resolvers across ~21 countries in parallel, returning each answer set, TTL, latency and a consensus count. Types: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, PTR. - [DNS Records Checker](/t/dns-records): `?domain=example.com&types=A,MX,CAA` - looks up 11 record types in parallel with real TTLs. - [DNSSEC Checker](/t/dnssec-check): `?domain=example.com` - validates the chain of trust by linking parent DS records to published DNSKEYs by key tag, and reports whether a validating resolver set the AD flag. Verdicts: `validated`, `broken`, `partial`, `not_detected`. - [IP Location Lookup](/t/ip-location): `?ip=8.8.8.8` - country, region, city, coordinates, accuracy radius, timezone, ASN and organisation from local MaxMind GeoLite2 data. - [IP WHOIS Lookup](/t/ip-whois): `?ip=8.8.8.8` - RDAP with WHOIS fallback. - [IP Blacklist Check](/t/ip-blacklist): `?ip=8.8.8.8` - DNSBL checks. - [What is my IP](/t/what-is-my-ip) - caller IP and sanitised proxy headers. - [HTTP Headers Check](/t/http-headers): `?url=https://example.com` - status, headers, redirect chain and timings, with SSRF protection. - [Website OS Check](/t/website-os): `?url=https://example.com` - heuristic, always labelled as a guess. - [SSL Certificate Checker](/t/ssl-check): `?host=example.com&port=443` - inspects the certificate chain the server actually presents: expiry, hostname match (CN + SANs, single-label wildcards per RFC 6125), chain completeness, self-signed, weak signature algorithms, key size, negotiated protocol. Connects with verification disabled on purpose so broken certificates can still be diagnosed rather than refused. - [Port Checker](/t/port-check): `?host=example.com&port=443` - connect-only reachability test. Deliberately constrained: fixed allow-list of 18 well-known ports, one host per request, no ranges or CIDR, private and metadata addresses refused, no banner read, stricter rate limit than the DNS tools. Distinguishes "connection refused" (nothing listening) from "timed out" (firewall dropping packets). - [Domain Blacklist Check](/t/email-blacklist): `?domain=example.com` - checks the domain against DBL/SURBL zones and its mail-server IPs against IP blocklists. Blocklists that refuse the query (Spamhaus and others reject lookups arriving via public resolvers) are reported as **not answered**, never as clean. - [Email Header Analyzer](/t/email-headers): **client-side only.** Accepts no header parameter by design — message headers contain recipient addresses, internal hostnames and subject lines, which a query parameter would record in the shareable URL, browser history and server access log. Parses locally: Received chain in chronological order with per-hop delays, originating public IP (private hops skipped), and SPF/DKIM/DMARC results. The JSON endpoint returns an explanation, not an analysis. - [MAC Address Lookup](/t/mac-lookup): `?mac=00:50:56:AA:BB:CC` - manufacturer from the local IEEE OUI registry, plus decoded local/universal and unicast/multicast flags. All three IEEE registries are imported (MA-L 24-bit, MA-M 28-bit, MA-S 36-bit) and matched longest-prefix-first, so small vendors are not misattributed to the parent block holder. - [SMTP Test](/t/smtp-test): `?host=mail.example.com&port=587` - TCP connect, banner, EHLO and optional STARTTLS with certificate summary. - [Password Generator](/t/password-generator): `?len=24` - never logged. - [Hash & Base64 Generator](/t/hash-generator): `?text=hello&mode=hash` - MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, plus Base64 encode/decode. MD5 and SHA-1 are labelled as checksum-only, never for passwords. - [Binary, Hex & Morse Translator](/t/text-converter): `?text=SOS&encoding=morse&direction=encode` - converts text to and from binary, hex, decimal and Morse in either direction. - [JSON Viewer, Beautifier & Minifier](/t/json-formatter): `?json=...&mode=beautify` - validates and reformats. On a syntax error it reports the exact line and column rather than just "Syntax error". - [Colour Converter](/t/color-converter): `?color=%233b82f6` - converts between HEX, RGB, HSL, HSV and CMYK with format auto-detection, and reports WCAG contrast ratios against black and white. - [MAC Address Generator](/t/mac-generator): `?count=5¬ation=colon` - random addresses with the locally-administered bit set and multicast cleared, so they cannot collide with manufacturer-assigned addresses. - [Password Strength Checker](/t/password-strength): **client-side only.** Accepts no password parameter by design — a password in a query string would land in the shareable URL, browser history and server access log. The estimate is computed in JavaScript and nothing is transmitted. The JSON endpoint returns an explanation, not an analysis. ## Accuracy notes These matter when reporting results: - **Propagation is measured by resolver, not by country.** Queries run from one server against public resolvers. Anycast resolvers (Cloudflare, Google, Quad9, OpenDNS) answer from whichever node is nearest that server and are labelled "Anycast (global)" rather than given a location. Only region-locked resolvers carry a country label. - **Resolver disagreement is often correct**, not a fault: CDN and geo-balanced hostnames legitimately return different answers per resolver. - **GeoLite2 city data is approximate.** Each result includes an accuracy radius; a radius of 1000km means "somewhere in this country". Do not present coordinates as precise. - **DNSSEC is never reported as validated** unless a validating resolver set the AD flag. ## Constraints - Private, loopback, link-local and cloud-metadata targets are refused. - Per-tool rate limits apply per IP. - Nothing is stored: no database, no logs of results, short-TTL file cache only.