AdminKit — full text
====================

## Home (https://adminkit.net/)

What is my IP — and is my connection safe?
AdminKit reads your IP, network and connection from this request and tells you what it means, in plain language — no account, no install.
AdminKit is the Machine Protocol Edge: free checks for the basics (IP, DNS, mail authentication, whois), and a protective layer for the connections devices and AI agents make that are not plain web traffic — device DNS, MQTT, Modbus, MCP/A2A.
AdminKit is a brand of Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC). No third-party ads. security.txt and a disclosure policy from day one.

## All tools (https://adminkit.net/tools/)

Every AdminKit check in one place, grouped by Network, Email, and Security & machines.

### What is my IP (https://adminkit.net/tools/my-ip/)
Status: live
Your public IP, ISP/ASN and approximate location, read from this request. We also flag CGNAT and show which DNS resolver you are using, computed entirely from the request with nothing stored and no third-party geolocation database queried at any point.

### DNS lookup (https://adminkit.net/tools/dns-lookup/)
Status: live
Look up A, AAAA, MX, TXT, NS, CAA and other DNS record types for any domain over DNS-over-HTTPS, with each type explained, using Cloudflare's public resolver through an AdminKit Pages Function that validates the query, times it out after 3 seconds, and caches each distinct result for 60 seconds.

### MX lookup (https://adminkit.net/tools/mx-lookup/)
Status: live
See the mail exchanger (MX) records for a domain, their priorities, and whether the hosts they point to resolve, with a second round of A/AAAA lookups for up to 5 mail hosts so you can spot a listed host that cannot actually receive mail.

### Reverse DNS (PTR) (https://adminkit.net/tools/reverse-dns/)
Status: live
Look up the PTR record for an IPv4 or IPv6 address to see the hostname it reverse-resolves to, if any, since many receiving mail servers check for a matching, sensible PTR record as a basic anti-spam signal before accepting mail.

### Whois / RDAP (https://adminkit.net/tools/whois/)
Status: live
Look up registrar, registration and expiry dates, status codes and nameservers for a domain, or the allocation and registry for an IP address, via RDAP, fetched directly from your browser via the public rdap.org proxy without AdminKit's servers ever seeing the query.

### Subnet calculator (https://adminkit.net/tools/subnet-calculator/)
Status: live
Enter a CIDR or an address and mask to get network address, broadcast address, usable host range and host count, for IPv4 and IPv6, calculated entirely in your browser as you type with nothing sent to a server at any point.

### DNS resolver / leak test (https://adminkit.net/tools/dns-resolver-test/)
Status: coming-soon
Will show which DNS resolver your requests actually travel through, using a unique disposable subdomain per visit, to help confirm whether your router or ISP is quietly overriding your chosen DNS settings or a hijack has occurred. Coming with the AdminKit API.

### SPF check (https://adminkit.net/tools/spf-check/)
Status: live
Parses your domain's SPF record, follows include/a/mx/ptr/exists/redirect mechanisms through nested includes, counts DNS lookups against the RFC 7208 limit of 10, and explains the strength of the trailing "all" mechanism and what exceeding the lookup limit does to mail delivery for the whole domain.

### DMARC check (https://adminkit.net/tools/dmarc-check/)
Status: live
Parses your domain's DMARC record (p, sp, rua, ruf, pct, adkim, aspf) and explains, in plain language, what will happen to mail that fails SPF or DKIM alignment, plus whether aggregate or forensic reports are configured to tell you about it.

### DKIM check (https://adminkit.net/tools/dkim-check/)
Status: live
Looks up a DKIM selector's TXT record, validates its syntax and public key, and explains common selector-hint patterns by provider, since DKIM keys are published per selector rather than per domain and there is no standard way to discover one from DNS alone.

### Blacklist (DNSBL) check (https://adminkit.net/tools/blacklist-check/)
Status: coming-soon
Will check an IP or sending domain against several major public DNSBLs in one pass, name which specific lists it is on, and explain how to request delisting from each, since a listing can cause mail servers to silently reject your mail. Coming with the AdminKit Check API.

### Open ports on my IP (https://adminkit.net/tools/port-check/)
Status: coming-soon
Will scan only the IP sending the request, only after explicit consent, against a fixed list of commonly exposed device ports such as Telnet, RTSP, MQTT, Modbus and BACnet, never an address you type in for someone else. Coming with the AdminKit Check API.

### SSL/TLS check (https://adminkit.net/tools/ssl-check/)
Status: coming-soon
Will show a hostname's full certificate chain, expiry date counted down in days, and which TLS protocol versions and cipher suites the server accepts, flagging deprecated ones such as TLS 1.0/1.1 and weak ciphers. Coming with the AdminKit Check API.

### HTTP security headers (https://adminkit.net/tools/http-headers/)
Status: coming-soon
Will fetch a URL's response headers and explain which security headers (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are present, with a suggested value for each one missing and a simple overall score so results stay scannable. Coming with the AdminKit Check API.

### MQTT exposure (https://adminkit.net/tools/mqtt-check/)
Status: coming-soon
Will probe whether a given host accepts anonymous MQTT connections on the standard plain (1883) or TLS (8883) ports, without subscribing to any topic or reading its content, and explain what an open broker exposes if found. Coming with the AdminKit Check API.

### Modbus exposure (https://adminkit.net/tools/modbus-check/)
Status: coming-soon
Will probe whether a host responds on Modbus/TCP port 502, without reading or writing any register, and flag the exposure as higher severity when it looks industrial alongside other OT-relevant ports, since Modbus/TCP has no built-in authentication. Coming with the AdminKit Check API.

### MCP endpoint check (https://adminkit.net/tools/mcp-check/)
Status: coming-soon
Will probe an MCP server's initialize and tools/list calls to check whether authentication is required and which tools are exposed, with a plain-language severity note based on what those tool names and descriptions suggest they can do. Coming with the AdminKit Check API.

### MAC vendor lookup (https://adminkit.net/tools/mac-lookup/)
Status: coming-soon
Will look up the IEEE-registered vendor for a MAC address's OUI prefix (its first three bytes) and flag locally-administered or randomised addresses. We are holding this page back while we confirm the IEEE OUI dataset's redistribution terms for a commercial product.

### User agent (https://adminkit.net/tools/user-agent/)
Status: live
Shows your browser's raw User-Agent header and a plain-language breakdown of the browser name and version, rendering engine, operating system and coarse device type it implies, parsed entirely in your browser with no server round trip or third-party UA database involved.

## Products (https://adminkit.net/products/protective-dns/)

Six layers on one control plane: L0 free checks, L1 Protective DNS for devices, L2 MCP/Agent Gateway and Agent Trust API, L3 Secure MQTT Broker, L4 zero-trust OT remote access, L5 embedded agent for OEMs. Each is honestly labelled early access or coming soon until fully live — see each product page for current status.

## Guides (https://adminkit.net/guides/)

### How to Secure an MCP Server | AdminKit Guide (https://adminkit.net/guides/how-to-secure-an-mcp-server/)
Status: live
Secure an MCP server by requiring OAuth authorization per the MCP specification, limiting which tools a client can call, and treating every tool response as untrusted input that could carry prompt-injection content — not just locking the front door and assuming the rest is safe.

### IPv6 at Home: Why No NAT Means a Firewall | AdminKit (https://adminkit.net/guides/ipv6-home-devices-need-a-firewall/)
Status: live
IPv4 NAT accidentally hides home devices behind one shared address, acting like a firewall even when nobody configured one. IPv6 gives every device its own globally routable address instead — which means an actual firewall, not NAT, is what's standing between your devices and the internet.

### Is Modbus TCP (Port 502) Exposed? | AdminKit (https://adminkit.net/guides/is-modbus-tcp-502-exposed/)
Status: live
Modbus TCP, the industrial protocol used by countless PLCs and controllers, has no built-in authentication at all. If a Modbus device is reachable on port 502 from the public internet, anything that can connect to it can typically read registers and, often, write to them — with nothing checking who's asking.

### Is My Router's DNS Hijacked? | AdminKit Guide (https://adminkit.net/guides/is-my-router-dns-hijacked/)
Status: live
DNS hijacking means something — malware, a compromised router, or an attacker with stolen credentials — changed which DNS resolver your traffic uses, letting it quietly redirect you to fake sites or intercept lookups. Confirm which resolver you're actually using; a mismatch from what you expect is the clearest sign.

### Is Port 1883 (MQTT) Open on My Router? | AdminKit (https://adminkit.net/guides/is-port-1883-mqtt-open/)
Status: live
Port 1883 is the default port for MQTT, a lightweight messaging protocol used by smart-home hubs, sensors and IoT platforms. If it's reachable from the public internet and the broker accepts anonymous connections — which the protocol allows by default — anyone who finds it can read or send messages.

### What Is CGNAT and Why It Confuses Sites | AdminKit (https://adminkit.net/guides/what-is-cgnat/)
Status: live
CGNAT (Carrier-Grade NAT) is when your ISP shares one public IP address across many customers at once, so a website sees that shared address, not just you — which explains unexplained CAPTCHAs, shared blacklist status, and why port forwarding sometimes doesn't work.

### Why Is My IP Address Blacklisted? | AdminKit Guide (https://adminkit.net/guides/why-is-my-ip-blacklisted/)
Status: live
Your IP is blacklisted because a spam trap, malware sensor or abuse report tied suspicious traffic back to it — often from a compromised device or a neighbour on a shared IP, not you personally. Check which list flagged you, fix the cause, then request removal from that list.

### SPF, DKIM and DMARC Explained | AdminKit Guide (https://adminkit.net/guides/spf-dkim-dmarc-explained/)
Status: live
SPF lists which servers may send mail for your domain, DKIM cryptographically signs messages so receivers can verify they weren't altered, and DMARC tells receivers what to do when a message fails both — and where to send reports. All three live in DNS as text records.


## Contact

General: hello@adminkit.net · Security: security@adminkit.net · Privacy: privacy@adminkit.net · Abuse: abuse@adminkit.net
Phone / WhatsApp: +84 937 869 689 (https://wa.me/84937869689)