thenetworkery

Origin AS, visibility, RPKI validity, upstreams and announced prefixes from the global routing table.

Is an IP, a domain or its mail servers on the spam blocklists receivers use – and how to get delisted.

Creates a public URL that records every request sent to it (webhooks, callbacks) for 7 days, and returns its bin id and key for the other webhook tools.

Every publicly logged certificate for a domain and its subdomains – find forgotten hosts and unexpected issuers.

Unregistered AS numbers, free IPv4 blocks and a random unused IPv6 /48 – checked against the live registry.

WireGuard, BIRD 2 and RouterOS 7 configs for a DN42 peering, following the wiki conventions.

Look up any DN42 object – AS, IP, prefix, maintainer, person or .dn42 domain – with everything linked to it.

Every record for a name from its authoritative nameservers or a public resolver, or one record compared across 13 resolvers worldwide.

Is the zone signed, does the chain of trust validate, and are the algorithms current?

DNS, DNSSEC, email security, blocklists, certificates, HTTPS and registration in one report with a security grade (A+ to F) and what to fix first.

SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI graded, with the exact records to fix what is missing.

Paste a message's headers to see its route and delays, SPF, DKIM and DMARC results with alignment, and why it may have gone to spam.

Build an SPF record from the services that send your mail, or a DMARC record from a policy, and compare it with the one you publish now.

One request received by a webhook URL in full (every header, the body, base64 if binary) with a curl command that sends it again.

Redirect chain, response headers and a graded check of HSTS, CSP and the other security headers.

Decode a JSON Web Token's header and claims, check alg, exp, nbf and iat, and verify its signature if you give a key; the token is never stored.

Requests a webhook URL received, oldest first: pass after_id for only newer ones, and wait_seconds to wait briefly for the next.

Who made a network card, from the IEEE registry – and whether the address is randomised.

Connect to a remote MCP server like an AI assistant would: handshake, tools, resources, prompts, OAuth discovery and context cost, checked against the spec.

Tests every nameserver of a domain directly: lame or unreachable servers, NS and glue mismatches, SOA serials, open recursion, TCP and EDNS.

Who holds an IP address, prefix or AS number, how it is routed (origin AS, RPKI, IRR), its reverse DNS, blocklist listings and PeeringDB record, with what to fix first.

A network’s peering policy, internet exchange ports, facilities and NOC contacts from PeeringDB.

Whether a TCP port is open, closed or filtered from the internet, from one timed connection from our server.

The PTR name of an IP address, whether it resolves back to the same IP (FCrDNS), and whether it looks generic.

Whether a route is RPKI valid, invalid or not found, with the ROAs covering the prefix, max-length mistakes and how to fix them.

Certificate, chain, expiry, hostname match, key strength and the TLS version a server negotiates.

Subnet ranges, masks and splits for IPv4 and IPv6, IPv6 and EUI-64 address details, and merging lists into the fewest CIDRs.

Who holds a domain, IP address or AS number – from the registry, via RDAP.