43 free tools
All AdminKit tools
Every AdminKit check, including IP, DNS, mail authentication, whois and device-exposure checks, lives in one place here, grouped into the six clusters used across the site. Most run the check for you in the browser; guided checks walk you through the same answer step by step, with no account needed.
Updated
DNS
DNS lookup
A, AAAA, MX, TXT, NS, CAA and more for any domain.
MX lookup
Mail exchanger records and their priorities for a domain.
Reverse DNS (PTR)
Resolve an IP address back to its hostname.
Whois / RDAP
Registrar, registration dates, status and nameservers for a domain or IP.
DNS resolver / leak test
Find which DNS resolver your connection is really using, step by step.
DNSSEC check
Live secure / insecure / bogus DNSSEC verdict for any domain.
DNS propagation check
See whether Cloudflare, Google, Quad9 and OpenDNS resolvers agree on a domain's records yet.
CAA record generator
Build CAA DNS records from authorized CAs, wildcard CAs and an iodef address, entirely client-side.
IDN homograph check: lookalike domains
Punycode and Unicode forms of a domain, with mixed-script and confusable-character flags — client-side.
PTR record generator
Compute the in-addr.arpa/ip6.arpa reverse-DNS name for an IP, or decode an arpa name back to its IP, entirely client-side.
Email authentication
SPF check
Validate your domain's SPF record and lookup count.
DMARC check
Validate your domain's DMARC policy and reporting tags.
DKIM check
Validate a DKIM selector's public key record.
Blacklist (DNSBL) check
Check an IP or domain against DNS-based blocklists, step by step.
SPF validator
Check an SPF record's syntax and lookup-term count offline, no DNS lookups.
MTA-STS check
Live enforce / testing / none / not-published verdict for a domain's MTA-STS policy.
BIMI check
Live published / not-published / invalid verdict for a domain's BIMI record, plus the DMARC-enforcement prerequisite.
TLS-RPT check
Live published / no-destination / not-published verdict for a domain's TLS-RPT record.
DMARC record generator
Build a DMARC TXT record from your settings, entirely client-side.
MTA-STS policy generator
Build an mta-sts.txt policy file and _mta-sts TXT record from your settings, entirely client-side.
SPF record generator
Build an SPF TXT record from your mail senders, entirely client-side.
BIMI record generator
Build a BIMI TXT record from your logo and VMC URLs, entirely client-side.
TLS-RPT record generator
Build the _smtp._tls TXT record from your rua report destinations, entirely client-side.
DKIM record generator
Build a DKIM TXT record from a public key, entirely client-side.
Email header analyzer
Read the Received chain, hop delays and Authentication-Results from pasted raw email headers, entirely client-side.
DMARC report analyzer
Read a DMARC aggregate (RUA) XML report: reporter, date range, and per source IP volume, SPF/DKIM alignment and applied policy, client-side.
DNS TXT record splitter
Split a long TXT value into correctly quoted 255-octet character-strings, entirely client-side.
SMTP status code decoder
Decode an SMTP reply code or bounce message's basic reply code and enhanced status code, entirely client-side.
IP & network
What is my IP
See your public IPv4/IPv6, ISP, ASN and approximate location.
Subnet calculator
IPv4 and IPv6 subnet, mask, range and host count math.
MAC vendor lookup
Look up the manufacturer that registered a MAC address prefix, live.
IP info: classify an address offline
Classify a single IPv4/IPv6 address's IANA special-use category and reverse-DNS form, offline.
IP in CIDR: does this address match my ranges?
Check a single address against one or more CIDR ranges — contained yes/no per range, offline.
IPv6 info: expand, compress, split an address
Expand/compress an IPv6 address, split prefix from interface id, classify its category, and convert MAC <-> modified EUI-64, offline.
CIDR aggregator: smallest prefix set
Merge a list of IPv4/IPv6 addresses and CIDR blocks into the fewest exact-cover prefixes.
Machine protocols
MQTT exposure
Check whether your own MQTT broker accepts unauthenticated connections, live.
Modbus exposure
Check whether your own Modbus/TCP device is reachable from the internet, live.
User agent
Parse and explain your browser's User-Agent string.
RTSP camera exposure
Check whether your own RTSP camera or video server is exposed and readable without authentication, live.
Security basics
Open ports on my IP
Scan your own public IP for commonly exposed TCP ports, live.
SSL/TLS check
Certificate, expiry and negotiated protocol/cipher for a host, checked live.
HTTP security headers
Check Content-Security-Policy, HSTS and other response headers, live.
Frequently asked questions
Which AdminKit tools are free?
All 43 of them. 41 run the check for you in the browser — IP, DNS, mail authentication (SPF/DMARC/DKIM), whois, subnet, user-agent, TLS, HTTP headers, MAC vendor, open-port and MCP-endpoint checks — with no account needed.
What is a guided check?
2 tools (DNS resolver / leak test, Blacklist (DNSBL) check) walk you through the check step by step with commands you run yourself, because the answer depends on your own resolver. Need it done across many sites or servers? Talk to our team at /contact/ about a Netbase engagement.
Do I need to create an account to use a tool?
No. Every live tool on this page runs without sign-up — results are not saved or tied to an account.
How are tools grouped on this page?
Into the same six clusters as the rest of the site (DNS, email authentication, IP & network, machine protocols, AI agents & MCP, security basics) — see /clusters/ for the guides and glossary terms on the same topics.