Skip to content
tlspeek

Public DNS, explained

Check the public signals behind mail and HTTPS.

tlspeek looks up mail DNS and response headers, and it includes a few tools that stay in the browser. It is free, it asks for no account, and it does not keep what you enter.

01

SPF checker
Read a domain's SPF record, count DNS lookups, and see whether +all, ?all, or a second record will cause a permanent error.

02

DMARC checker
Fetch the _dmarc TXT record, grade p, sp, pct, rua, ruf, adkim, and aspf, and read what each tag asks receivers to do.

03

DKIM lookup
Find a selector's public key, estimate its length, and flag keys that are short, revoked, or still in test mode.

04

Security headers
Request a URL and grade HSTS, CSP, framing, nosniff, referrer policy, permissions, and cross-origin headers.

05

HSTS checker
See whether Strict-Transport-Security is present, long enough, and shaped for the preload list.

06

MX lookup
Read the mail servers for a domain, lowest preference first, including a null MX.

07

MTA-STS checker
Read the _mta-sts TXT id and the HTTPS policy file, and compare mx patterns with published MX hosts.

08

CAA checker
See which certificate authorities a domain allows, and whether an empty issue tag denies issuance.

09

BIMI checker
Read the logo record at selector._bimi, including an empty l tag that declines a logo.

10

SPF generator
Build an SPF TXT value in the browser from includes, addresses, and an all term.

11

Password policy
Write a length and character-class policy in the browser. Nothing is uploaded.

12

JWT decoder
Decode a token header and payload locally. The signature is not checked and the token is not sent.

Building a record instead of reading one? The DMARC generator and the SPF generator stay in your browser.

How a lookup works

  1. You type a domain. A selector is optional for DKIM. The generator never sends the form.
  2. We ask Cloudflare's public resolver. The checker requests TXT records, and SPF may also request MX records named by the policy, over DNS-over-HTTPS.
  3. You get an explanation. Mechanisms, tags, lookup counts, and key length are described in ordinary language, with a suggestion when something is weak.