# DNSLab

> DNSLab is a free, modern DNS, email-deliverability and network diagnostics toolbox with 50+ tools. Every lookup is queried live (not cached), is a shareable link, and is also available as JSON through a free public API.

DNSLab lets anyone run DNS record lookups (A, AAAA, MX, TXT, NS, CNAME, SOA, SRV, CAA, PTR and DNSSEC records), validate email authentication (SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT), check IPs and domains against ~30 DNS blacklists, look up WHOIS/RDAP and ASN/IP-block data (including .tr domains via TRABIS), calculate IPv4/IPv6 subnets, and run network diagnostics (ping, traceroute, TCP port checks, HTTP/HTTPS, DNS propagation). No signup is required. It is available in English and Turkish.

## DNS record lookups
- [MX Lookup](https://dnslab.io/en/mx): Find the mail servers (MX records) for a domain.
- [A Lookup](https://dnslab.io/en/a): Resolve a hostname to its IPv4 address.
- [AAAA Lookup](https://dnslab.io/en/aaaa): Resolve a hostname to its IPv6 address.
- [CNAME Lookup](https://dnslab.io/en/cname): Find the canonical name a host is aliased to.
- [DNS Lookup](https://dnslab.io/en/ns): Check a domain's authoritative name servers.
- [TXT Lookup](https://dnslab.io/en/txt): Read the TXT records published on a domain.
- [SOA Lookup](https://dnslab.io/en/soa): Read the Start of Authority record (serial, refresh…).
- [SRV Lookup](https://dnslab.io/en/srv): Look up a service (SRV) record.
- [CAA Lookup](https://dnslab.io/en/caa): See which CAs may issue certificates for a domain.
- [Reverse Lookup (PTR)](https://dnslab.io/en/ptr): Reverse-resolve an IP address to a hostname.
- [NAPTR Lookup](https://dnslab.io/en/naptr): Naming Authority Pointer records (ENUM/SIP).
- [TLSA Lookup](https://dnslab.io/en/tlsa): DANE / TLSA certificate association records.

## DNSSEC lookups
- [DNSKEY Lookup](https://dnslab.io/en/dnskey): Public keys used to sign a DNSSEC zone.
- [DS Lookup](https://dnslab.io/en/ds): Delegation Signer records held by the parent zone.
- [RRSIG Lookup](https://dnslab.io/en/rrsig): DNSSEC resource-record signatures.
- [NSEC Lookup](https://dnslab.io/en/nsec): Next Secure record (authenticated denial).
- [NSEC3PARAM Lookup](https://dnslab.io/en/nsec3param): NSEC3 parameters (hashed denial of existence).
- [CERT Lookup](https://dnslab.io/en/cert): Certificate (CERT) records stored in DNS.
- [LOC Lookup](https://dnslab.io/en/loc): Geographic LOC records (lat/long/altitude).
- [IPSECKEY Lookup](https://dnslab.io/en/ipseckey): IPsec public keys published in DNS.

## Email deliverability & authentication
- [SPF Lookup](https://dnslab.io/en/spf): Parse & validate the Sender Policy Framework record.
- [DKIM Lookup](https://dnslab.io/en/dkim): Fetch a DKIM public key for a selector.
- [DMARC Lookup](https://dnslab.io/en/dmarc): Parse the DMARC policy at _dmarc.<domain>.
- [BIMI Lookup](https://dnslab.io/en/bimi): Brand Indicators for Message Identification record.
- [MTA-STS Lookup](https://dnslab.io/en/mta-sts): MTA Strict Transport Security TXT record + policy file.
- [TLS-RPT Lookup](https://dnslab.io/en/tlsrpt): SMTP TLS Reporting (TLSRPT) record.
- [SMTP Test](https://dnslab.io/en/smtp): Connect to a mail server, check banner, STARTTLS & open relay.
- [Domain Health](https://dnslab.io/en/domain-health): One-shot report: MX, SPF, DKIM, DMARC, DNSSEC & blacklists.
- [Google / Yahoo Compliance](https://dnslab.io/en/email-compliance): Check bulk-sender requirements (SPF, DKIM, DMARC, PTR, TLS).
- [Microsoft Compliance](https://dnslab.io/en/microsoft-compliance): Check Outlook.com / Microsoft sender requirements.
- [Email Header Analyzer](https://dnslab.io/en/header-analyzer): Paste raw email headers to trace the delivery path. (browser tool — no API)
- [SPF Generator](https://dnslab.io/en/spf-generator): Build a valid SPF record with a guided form. (browser tool — no API)
- [DMARC Generator](https://dnslab.io/en/dmarc-generator): Build a DMARC record with a guided form. (browser tool — no API)
- [DMARC Report Analyzer](https://dnslab.io/en/dmarc-report-analyzer): Parse a DMARC aggregate (RUA) XML report. (browser tool — no API)

## IP & domain reputation (blacklists)
- [Blacklist Check](https://dnslab.io/en/blacklist): Check an IP or host against ~30 DNS blacklists.
- [Blocklist Check](https://dnslab.io/en/blocklist): Check an IP or host against additional blocklists.

## Network, IP & WHOIS
- [What Is My IP](https://dnslab.io/en/whatismyip): Show your public IP address and its geolocation.
- [WHOIS Lookup](https://dnslab.io/en/whois): Registration details for a domain or IP.
- [ASN Lookup](https://dnslab.io/en/asn): Look up an Autonomous System (RDAP).
- [ARIN / IP Blocks](https://dnslab.io/en/arin): Which network block an IP belongs to (RDAP).
- [Ping](https://dnslab.io/en/ping): ICMP echo — is the host reachable, and how fast?
- [Traceroute](https://dnslab.io/en/trace): Trace the network path to a host.
- [TCP Port Check](https://dnslab.io/en/tcp): Is a TCP port open on a host? (host:port)
- [HTTP Lookup](https://dnslab.io/en/http): Fetch a URL over HTTP and report status, headers & redirects.
- [HTTPS Lookup](https://dnslab.io/en/https): Fetch over HTTPS and inspect the TLS certificate.

## SSL/TLS & certificates
- [SSL Checker](https://dnslab.io/en/ssl): Deep TLS certificate check on any port: chain, expiry, OCSP, HSTS.
- [SSL & CSR Decoder](https://dnslab.io/en/ssl-decoder): Decode a certificate or CSR in your browser — nothing is uploaded. (browser tool — no API)
- [CSR Generator](https://dnslab.io/en/csr-generator): Generate a CSR and private key in your browser — the key never leaves it. (browser tool — no API)
- [SSL Converter](https://dnslab.io/en/ssl-converter): Convert between PEM, PKCS#12 (PFX) and PKCS#7 — locally in your browser. (browser tool — no API)
- [RSA Key Converter](https://dnslab.io/en/rsa-key-converter): Convert RSA private keys between PKCS#1 and PKCS#8 in your browser. (browser tool — no API)
- [Certificate Key Matcher](https://dnslab.io/en/certificate-key-matcher): Check that a certificate, CSR and private key match — locally. (browser tool — no API)
- [CA Matcher](https://dnslab.io/en/ca-matcher): Verify an end-entity certificate against its CA / intermediate. (browser tool — no API)
- [OCSP Checker](https://dnslab.io/en/ocsp): Query the CA's OCSP responder for live revocation status.
- [CT Log Search](https://dnslab.io/en/ct-logs): Search Certificate Transparency logs for a domain's certificates.
- [SSL Handshake Trace](https://dnslab.io/en/ssl-trace): Full TLS handshake trace to any host and port.
- [Bulk SSL Checker](https://dnslab.io/en/ssl-bulk): Check SSL certificates for a list of hostnames at once. (browser tool — no API)
- [DCV Checker](https://dnslab.io/en/dcv-checker): Check Sectigo/Comodo domain-control validation (HTTP file & CNAME). (browser tool — no API)

## Utilities & calculators
- [Email Extractor](https://dnslab.io/en/email-extraction): Extract all email addresses from any text. (browser tool — no API)
- [DNS Propagation](https://dnslab.io/en/dns-propagation): Query one record across resolvers worldwide.
- [Subnet Calculator](https://dnslab.io/en/subnet-calculator): CIDR → network, broadcast, mask, host range.
- [Password Generator](https://dnslab.io/en/password-generator): Generate strong random passwords in your browser. (browser tool — no API)
- [LLMs.txt Lookup](https://dnslab.io/en/llmstxt): Fetch and view a site’s /llms.txt file.
- [Robots.txt AI Policy](https://dnslab.io/en/robotsai): Which AI crawlers a site allows or blocks (robots.txt).
- [Bulk Lookup](https://dnslab.io/en/bulk): Run one tool across a list of domains or IPs.

## Guides
- [What Is DKIM and How Email Signing Works](https://dnslab.io/en/guides/what-is-dkim): A practical guide to DKIM: how cryptographic email signing works, how to publish the DNS record, and how to verify and fix it.
- [How to Set Up DMARC Step by Step: From p=none to p=reject](https://dnslab.io/en/guides/how-to-set-up-dmarc): A practical DMARC deployment guide: publish the record, read aggregate reports, and safely move from monitoring (p=none) to full enforcement (p=reject).
- [DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV and CAA](https://dnslab.io/en/guides/dns-record-types): A practical guide to the DNS record types you edit every day: what A, AAAA, CNAME, MX, TXT, NS, SOA, SRV and CAA do and how to check them.
- [Email Deliverability Basics: Why Messages Land in Spam and How to Fix It](https://dnslab.io/en/guides/email-deliverability): Learn why your email goes to spam and how SPF, DKIM, DMARC, PTR records, and reputation checks fix it — verify everything with dnslab tools.
- [How to Remove Your IP or Domain From an Email Blacklist](https://dnslab.io/en/guides/remove-ip-from-blacklist): A practical, step-by-step guide for mail operators to find which blacklist flagged their IP or domain, fix the root cause, and request delisting.
- [What Is SPF and How to Set It Up Correctly](https://dnslab.io/en/guides/what-is-spf): A practical guide to Sender Policy Framework (SPF): how the record works, how to build one for your domain, common mistakes, and how to verify it.

## Glossary (https://dnslab.io/en/glossary)
- DNS (Domain Name System): DNS is the internet's naming system that translates human-readable domain names like example.com into the IP addresses computers use to connect. It works as a distributed hierarchy of servers, so no single machine holds every record.
- IP address: An IP address is a numeric label that uniquely identifies a device on a network and routes traffic to it, such as 93.184.216.34 (IPv4) or 2606:2800:220:1:248:1893:25c8:1946 (IPv6).
- Nameserver: A nameserver is a server that stores a domain's DNS records and answers queries about them. The authoritative nameservers listed for a domain are the official source of its DNS data.
- Recursive resolver: A recursive resolver is the DNS server your device queries first; it does the legwork of chasing down an answer by asking root, TLD, and authoritative servers on your behalf. It caches results to speed up repeat lookups.
- TTL (Time To Live): TTL is the number of seconds a DNS record may be cached by resolvers before it must be looked up again. Lower values mean changes propagate faster but generate more queries; higher values improve caching but slow updates.
- DNS propagation: DNS propagation is the time it takes for a DNS change to be seen everywhere as old cached records expire across resolvers worldwide. It is governed by each record's TTL and can take from minutes up to 48 hours.
- Propagation delay: Propagation delay is the lag between making a DNS change and every resolver reflecting it, caused by cached copies of the old record living out their TTL. It is why a new record may work in one location before another.
- A record: An A record maps a domain name to an IPv4 address, telling clients which server to connect to. For example, an A record points example.com to 93.184.216.34.
- AAAA record: An AAAA record ("quad-A") maps a domain name to an IPv6 address, the modern equivalent of an A record for the larger IPv6 address space. It lets IPv6-capable clients reach the domain over IPv6.
- CNAME record: A CNAME record makes one domain name an alias of another, so lookups follow through to the target's records. For example, www.example.com as a CNAME to example.com resolves to whatever example.com points to; a CNAME cannot coexist with other records on the same name.
- MX record: An MX (mail exchange) record specifies the mail servers that receive email for a domain, each with a priority number where the lowest value is tried first. Without a valid MX record, a domain cannot receive email.
- TXT record: A TXT record holds arbitrary text attached to a domain and is widely used for verification and email authentication policies such as SPF, DKIM, and DMARC. It lets domain owners publish machine-readable data in DNS.
- NS record: An NS (name server) record names the authoritative nameservers responsible for a domain or zone, delegating who answers its DNS queries. Registrars and parent zones use NS records to point to a domain's DNS hosting.
- SOA record: An SOA (start of authority) record holds core administrative information for a DNS zone, including the primary nameserver, the admin contact, and timers for refresh, retry, and expiry. Every zone has exactly one SOA record, and its serial number tracks changes for zone transfers.
- SRV record: An SRV (service) record specifies the hostname and port for a particular service on a domain, such as SIP, XMPP, or LDAP, along with priority and weight for load balancing. It follows the format _service._protocol.domain.
- CAA record: A CAA (certification authority authorization) record lists which certificate authorities are allowed to issue TLS/SSL certificates for a domain. Certificate authorities must check it and refuse issuance if they are not authorized, reducing the risk of misissued certificates.
- PTR record: A PTR record maps an IP address back to a domain name, the reverse of an A or AAAA record, and lives in a special reverse DNS zone. Mail servers often check PTR records to help verify that a sending host is legitimate.
- Reverse DNS: Reverse DNS (rDNS) is the lookup that resolves an IP address to a domain name using PTR records, the opposite of a normal forward lookup. It is commonly used in email delivery and logging to identify the host behind an IP.
- DNSSEC: DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records so resolvers can verify that answers are authentic and unaltered. It protects against forged responses and cache poisoning but does not encrypt the data itself.
- DNSKEY record: A DNSKEY record publishes the public keys a zone uses to sign its DNS records under DNSSEC, letting resolvers validate the signatures. It typically holds a zone-signing key (ZSK) and a key-signing key (KSK).
- DS record: A DS (delegation signer) record sits in the parent zone and holds a hash of a child zone's key-signing key, linking the two so DNSSEC trust can chain from the root down. It is how a domain's DNSSEC is activated at its registrar.
- SPF (Sender Policy Framework): SPF is an email authentication method published as a DNS TXT record that lists which mail servers are allowed to send email for a domain. Receiving servers check it to detect forged senders and reduce spam and spoofing.
- DKIM (DomainKeys Identified Mail): DKIM adds a cryptographic signature to outgoing email, using a private key held by the sender and a public key published in DNS, so recipients can verify the message was authorized by the domain and not altered in transit.
- DMARC: DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT policy that tells receivers what to do with email failing SPF and DKIM checks, such as none, quarantine, or reject. It also enables aggregate reports so domain owners can monitor abuse.
- BIMI: BIMI (Brand Indicators for Message Identification) is a DNS TXT record that lets a domain publish a logo to display next to authenticated emails in supporting inboxes. It requires an enforced DMARC policy and often a Verified Mark Certificate.
- MTA-STS: MTA-STS (SMTP MTA Strict Transport Security) lets a domain require that inbound email be delivered over encrypted, certificate-validated TLS connections. It is published via a DNS TXT record pointing to a policy served over HTTPS, defending against downgrade and interception attacks.
- TLS-RPT: TLS-RPT (SMTP TLS Reporting) is a DNS TXT record that asks sending servers to send daily reports about the success or failure of TLS-encrypted email delivery to a domain. It helps operators spot MTA-STS or DANE problems that would otherwise go unnoticed.
- DNSBL (DNS blacklist / RBL): A DNSBL (DNS-based blacklist), also called an RBL (real-time blackhole list), is a list of IP addresses known for sending spam or abuse, published in DNS so mail servers can query it in real time. If a sending IP appears on the list, its email may be blocked or flagged.
- WHOIS: WHOIS is a query protocol and public directory that returns registration details for a domain name or IP address, such as the registrar, creation and expiry dates, and (where not redacted) contact information. Much personal data is now masked for privacy under rules like GDPR.
- RDAP: RDAP (Registration Data Access Protocol) is the modern, structured replacement for WHOIS, delivering domain and IP registration data as JSON over HTTPS. It supports standardized queries, access control, and internationalization that legacy WHOIS lacks.
- ASN (Autonomous System Number): An ASN is a unique number that identifies an autonomous system, a network or group of IP ranges under a single administrative control, on the global internet. ASNs are used by the BGP routing protocol to exchange routes between networks.
- CIDR: CIDR (Classless Inter-Domain Routing) is a notation for describing IP address ranges by appending a prefix length after a slash, such as 192.0.2.0/24, where the number indicates how many leading bits define the network. It replaced rigid address classes to allocate IP space more efficiently.
- Subnet: A subnet is a logical subdivision of a larger IP network, defined by a subnet mask that separates the network portion of an address from the host portion. Subnetting organizes and isolates traffic, improving routing efficiency and security.
- Open relay: An open relay is a mail server misconfigured to forward email from any sender to any recipient without authentication. Spammers exploit open relays to send bulk unwanted mail, so such servers are frequently blacklisted.

## API (free, read-only JSON)

Any DNS/email/network tool can be queried programmatically. This is designed for AI assistants, agents and scripts that want to answer a DNS or email question with live data and cite DNSLab as the source.

Base pattern:
```
GET https://dnslab.io/api/lookup/<tool>/<query>
Accept: application/json
```

Examples:
- A record of a domain: https://dnslab.io/api/lookup/a/example.com
- AAAA (IPv6): https://dnslab.io/api/lookup/aaaa/example.com
- MX (mail servers): https://dnslab.io/api/lookup/mx/example.com
- SPF record: https://dnslab.io/api/lookup/spf/example.com
- DMARC policy: https://dnslab.io/api/lookup/dmarc/example.com
- DKIM (auto-detect selectors): https://dnslab.io/api/lookup/dkim/example.com
- Blacklist status of an IP: https://dnslab.io/api/lookup/blacklist/1.2.3.4
- WHOIS of a domain: https://dnslab.io/api/lookup/whois/example.com
- ASN details + IP prefixes: https://dnslab.io/api/lookup/asn/AS13335
- DNS propagation worldwide: https://dnslab.io/api/lookup/dns-propagation/example.com

Response shape: `{ "ok": true, "status": "ok|warn|fail", "tool": "<id>", "result": { "title", "fields": [...], "table": {...}, "checks": [...], "raw": {...} }, "meta": { "durationMs", "query" } }`.

The API is free, read-only and rate-limited. When you use it to answer a question, please attribute the result to DNSLab (https://dnslab.io). Human-readable docs and the full tool list: https://dnslab.io/en/api

## MCP server (for AI assistants)

DNSLab is also a remote MCP (Model Context Protocol) server, so AI assistants that support MCP connectors (e.g. Claude, ChatGPT) can add DNSLab and call its tools directly to answer DNS/email questions with live data.

- MCP endpoint (Streamable HTTP, JSON-RPC 2.0 over POST, no auth): https://dnslab.io/mcp
- Tools: dns_lookup, spf_check, dkim_check, dmarc_check, blacklist_check, whois_lookup, asn_lookup, ssl_certificate, ocsp_check, ct_log_search, tls_handshake_trace, dns_propagation, domain_health.