Email security check: SPF, DMARC, DNSSEC
Read a domain’s SPF, DMARC, MX, DNSSEC, MTA-STS and CAA records live from DNS and see whether its mail can be forged.
What is checked
SPF lists which servers may send mail for a domain. DMARC tells receivers what to do with mail that fails, and only the policies quarantine and reject actually stop forgeries. DNSSEC signs DNS answers, MTA-STS enforces encrypted delivery and CAA restricts who may issue certificates. All lookups go to Cloudflare’s public DNS-over-HTTPS resolver.
More tools
- Password leak checkCheck whether a password appears in known data breaches. It is hashed in your browser; only the first five characters of the hash are sent (k-anonymity).
- CVSS 3.1 calculatorBuild a CVSS 3.1 base vector and get the score instantly. Runs in your browser, with a visual plot of the result.
- SHA-256, SHA-1 and SHA-512 hash calculatorHash text or files with SHA-256, SHA-1 and SHA-512. Computed locally; files are never uploaded.
- IOC extractor and defangerExtract IPs, domains, URLs, hashes and CVE IDs from any text and get them deduplicated and defanged.
- Base64, URL, hex and JWT decoderEncode and decode Base64, URL encoding and hex, and read JWT headers and payloads. Nothing leaves your browser.
- IPv4 subnet calculatorNetwork, broadcast, usable range, netmask and wildcard for any IPv4 CIDR block.
- Secure password generatorGenerate long random passwords from your browser’s cryptographic source, without look-alike characters.