# Kirk Diamond: developer tools for DNS, SSL/TLS, HTTP and email > Free diagnostic tools and short first-hand guides by Kirk Diamond, an infrastructure engineer. Every server-side tool answers plain text to curl and JSON on request, with no key and no sign-up. Nothing you look up is stored. ## MCP server Agents can use the tools and the guides over the Model Context Protocol (Streamable HTTP, stateless, no auth): https://kirkdiamond.com/mcp ```json { "mcpServers": { "kirkdiamond": { "type": "http", "url": "https://kirkdiamond.com/mcp" } } } ``` Tools: domain_health, dns, dns_trace, tls, chain, cert_renewal, mail, http, ipinfo, search_guides, get_guide. Every guide is also a resource at its canonical URL. Details: https://kirkdiamond.com/api#mcp ## Server-side tools (HTTP API) - [Domain Health checker](https://kirkdiamond.com/domain-health): One check across DNS, SSL/TLS, HTTP and email for a domain: address records and nameservers, certificate chain and expiry, HTTPS redirect and security headers, SPF, DKIM and DMARC. Graded, with every finding explained and a link to the full report. API: https://kirkdiamond.com/api#api-domain-health - [DNS lookup](https://kirkdiamond.com/tools/dns): Look up A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV and PTR records against Cloudflare, Google, Quad9 or a resolver you choose. Shows TTLs, response codes and timings, so you can check propagation. API: https://kirkdiamond.com/api#api-dns - [DNS trace & propagation checker](https://kirkdiamond.com/tools/dns-trace): dig +trace without the incantation: walk a name from the root servers through each delegation to the authoritative answer, then see every authoritative server's answer and serial and what Cloudflare, Google, Quad9 and OpenDNS are caching, side by side. Flags stale glue, mismatched NS sets, lame servers and resolvers still serving the old record. API: https://kirkdiamond.com/api#api-dns-trace - [SSL/TLS certificate checker](https://kirkdiamond.com/tools/tls): Connect to any host and read back the certificate chain, expiry date, SANs, key type, negotiated protocol and cipher, ALPN, OCSP stapling and which TLS versions the server still accepts. API: https://kirkdiamond.com/api#api-tls - [SSL certificate chain checker](https://kirkdiamond.com/tools/chain): Will your certificate fail in curl, Java, Python or Android while it works in Chrome? One handshake captures the chain exactly as served and shows a verdict for 13 clients, the missing intermediate, and the fullchain.pem and server config that fix it. API: https://kirkdiamond.com/api#api-chain - [SSL certificate renewal checker](https://kirkdiamond.com/tools/cert-renewal): Will your SSL renewals survive 100-day and 47-day certificates? Checks the certificate on every address your name resolves to and asks your CA when it wants it renewed, then says whether renewal is automated and what breaks first. API: https://kirkdiamond.com/api#api-cert-renewal - [Email deliverability checker](https://kirkdiamond.com/tools/mail): SPF, DKIM, DMARC and MX in one report: MX hosts and whether they speak STARTTLS, SPF parsed as a tree with the 10-lookup and void-lookup counts (duplicates counted as receivers do, CNAME chains shown), DMARC policy decoded, DKIM keys for common selectors, MTA-STS validated and matched against the MX hosts, TLS-RPT and BIMI. API: https://kirkdiamond.com/api#api-mail - [HTTP header & redirect checker](https://kirkdiamond.com/tools/http): Fetch a URL and see every redirect hop with its status, a timing breakdown per hop (DNS, connect, TLS, first byte, download), the final response headers, protocol and compression, and a plain-English scorecard of the security headers and cookie flags. API: https://kirkdiamond.com/api#api-http - [Webhook tester & request bin](https://kirkdiamond.com/tools/bin): A throwaway URL that records every request sent to it and shows them live. Point a webhook at it and watch it land, then replay it as curl. API: https://kirkdiamond.com/api#api-bin - [HTTP request header checker](https://kirkdiamond.com/tools/headers): Echo every HTTP header your browser or client sent, exactly as this server received it. Handy for debugging proxies, CDNs, load balancers and User-Agent or Accept negotiation. API: https://kirkdiamond.com/api#api-headers - [HTTP status code tester](https://kirkdiamond.com/tools/status): Return any HTTP status code from 200 to 599, optionally after a delay. For testing retries, timeouts, error handling and uptime monitors. API: https://kirkdiamond.com/api#api-status - [ASN & IP lookup](https://kirkdiamond.com/tools/ipinfo): Who owns an IP address: reverse DNS, origin ASN and network name, announced BGP prefix, registry country and the RIR's own RDAP record. API: https://kirkdiamond.com/api#api-ipinfo - [What is my IP address](https://kirkdiamond.com/tools/ip): Your public IPv4 or IPv6 address as the server sees it, plus any X-Forwarded-For, Forwarded or Via headers a proxy or VPN added in front of it. API: https://kirkdiamond.com/api#api-ip ## Browser-only tools These run entirely in the visitor's browser and have no API. On their own pages they register with WebMCP for in-browser agents. - [JSON formatter, validator & viewer](https://kirkdiamond.com/tools/json): Paste JSON to validate it, format or minify it, browse it as a collapsible tree, edit keys and values in place and copy it back out. Runs in your browser. - [JWT decoder](https://kirkdiamond.com/tools/jwt): Paste a JSON Web Token and read the header, payload and expiry. Flags expired and not-yet-valid tokens. Nothing leaves your browser. - [Base64 & URL encoder/decoder](https://kirkdiamond.com/tools/encode): Encode and decode Base64, Base64url and URL percent-encoding in both directions, UTF-8 safe, in your browser. - [Unix timestamp converter](https://kirkdiamond.com/tools/epoch): Convert Unix epoch seconds, milliseconds, microseconds or nanoseconds to ISO 8601, UTC and local time, and back. Live current timestamp and code snippets for common languages. - [Text & JSON diff checker](https://kirkdiamond.com/tools/diff): Compare two blocks of text by line, word or character, side by side or unified. Ignore whitespace or case, sort JSON keys so reordering is not a change, copy the result as a patch. - [Hash & HMAC generator](https://kirkdiamond.com/tools/hash): SHA-256, SHA-1, SHA-384, SHA-512, MD5 and CRC32 of text or a dropped file, HMAC with a key, hex or Base64, and a verifier that tells you which algorithm a checksum came from. ## Guides ### DNS - [NXDOMAIN vs SERVFAIL: what each DNS error means and how to fix it](https://kirkdiamond.com/guides/nxdomain-vs-servfail): The two DNS response codes you will actually meet in production, what causes each, how to tell them apart in dig and a resolver comparison, and what to change. - [How long does DNS propagation take? TTLs, caches and how to check](https://kirkdiamond.com/guides/how-long-does-dns-propagation-take): DNS does not propagate, caches expire. What actually decides how quickly a record change is seen, how to plan a cutover, and how to check individual resolvers. - [CNAME vs A record, and why a CNAME at the apex fails](https://kirkdiamond.com/guides/cname-vs-a-record): When to point a name at an address and when to alias it, what a CNAME drags along, why the zone apex cannot be one, and what ALIAS and flattening do. - [CAA records: how they block the wrong CA and how they break renewals](https://kirkdiamond.com/guides/caa-records-explained): What a CAA record tells a certificate authority, the issue, issuewild and iodef tags, and the renewal failure that appears months after someone adds one. ### Email - [The SPF 10 DNS lookup limit: why it breaks and how to fix it](https://kirkdiamond.com/guides/spf-10-dns-lookup-limit): What counts towards the SPF lookup limit, why one more SaaS provider silently turns SPF off, and the options for getting back under ten lookups. - [DMARC p=none vs quarantine vs reject: which policy to use and when to move](https://kirkdiamond.com/guides/dmarc-none-vs-quarantine-vs-reject): What each DMARC policy tells receivers, why nearly everyone should start at none, how to read the reports and when to move to quarantine, then reject. - [SPF PermError: what causes it and how to fix it](https://kirkdiamond.com/guides/spf-permerror): Too many DNS lookups, two records, a syntax slip or a dead include. What SPF PermError means to receivers, how to find your cause, and the fix for each. - [SPF vs DKIM vs DMARC: what each one proves and why you need all three](https://kirkdiamond.com/guides/spf-vs-dkim-vs-dmarc): SPF checks the sending server, DKIM the message, DMARC what happens when they disagree with the From address. The gaps in each and how they fit together. - [MTA-STS explained: forcing TLS on inbound mail without breaking delivery](https://kirkdiamond.com/guides/mta-sts-explained): Why STARTTLS alone can be stripped, what an MTA-STS policy tells senders, the record and policy file, testing versus enforce, and TLS-RPT reports. - [MTA-STS max_age and the policy cache: why mail bounced a week after you changed MX](https://kirkdiamond.com/guides/mta-sts-max-age-and-policy-cache): Senders cache your MTA-STS policy for max_age seconds, so an MX migration can bounce mail a week later. The safe order of changes and what max_age to pick. - [DKIM body hash did not verify: what changed the message and how to find it](https://kirkdiamond.com/guides/dkim-body-hash-did-not-verify): Body hash did not verify means the message changed after signing: a list footer, a gateway disclaimer or re-encoding. How to find what touched it. - [550 5.7.26 unauthenticated email: how to pass the Gmail and Yahoo sender rules](https://kirkdiamond.com/guides/550-5-7-26-unauthenticated-email): Gmail's 5.7.26 bounce means SPF, DKIM or DMARC alignment failed. The two variants, what Gmail and Yahoo require of senders, and how to find the cause. ### TLS - [SSL certificate chains explained: leaf, intermediate, root and the missing intermediate problem](https://kirkdiamond.com/guides/certificate-chain-explained): What a certificate chain is, why the server sends the intermediates and the client supplies the root, and the chain faults that break real deployments. - [TLS 1.2 vs TLS 1.3: what changed and what to switch off](https://kirkdiamond.com/guides/tls-1-2-vs-1-3): The round trip saved, the cipher suites that went away, why forward secrecy is no longer optional, what still needs 1.2, and how to check a server. - [Why your SSL certificate works in Chrome but fails in curl, Java, Python and Android](https://kirkdiamond.com/guides/works-in-chrome-fails-in-curl): Browsers fetch the intermediate your server forgot to send; curl, Python, Java and Android do not. Why it hides in testing, each client's error, and the fix. - [unable to get local issuer certificate: what it means and how to fix it](https://kirkdiamond.com/guides/unable-to-get-local-issuer-certificate): OpenSSL error 20 has two causes: the server did not send its intermediate, or your trust store lacks the root. How to tell them apart and fix each. - [How to build a correct fullchain.pem for nginx, Apache, HAProxy and load balancers](https://kirkdiamond.com/guides/how-to-build-fullchain-pem): Leaf first, then intermediates, no root. Build fullchain.pem from certbot or a CA's zip, verify it, and see where nginx, Apache, HAProxy and clouds want it. - [SSL_ERROR_BAD_CERT_DOMAIN and ERR_CERT_COMMON_NAME_INVALID: the certificate is for another name](https://kirkdiamond.com/guides/ssl-error-bad-cert-domain): Firefox and Chrome refuse a certificate that does not list the name you asked for. How to tell a wrong default certificate from a missing SAN, and fix each. - [certificate has expired and ERR_CERT_DATE_INVALID: which certificate, and why](https://kirkdiamond.com/guides/certificate-has-expired): The leaf, an intermediate or the client's clock: how to tell which one expired, why renewals fail silently, and how to monitor certificate expiry from CI. - [self-signed certificate in certificate chain: what it means for npm, pip, git and curl](https://kirkdiamond.com/guides/self-signed-certificate-in-certificate-chain): Why npm, pip, git and curl fail while the browser works: a corporate proxy or a private CA. How to tell which, and how to add the root without disabling checks. - [47-day SSL certificates: the timeline, what breaks and how to get ready](https://kirkdiamond.com/guides/47-day-ssl-certificates): Certificate lifetimes drop to 100 days in March 2027 and 47 in 2029. What the dates mean, which setups break first, and how to check yours is automated. - [ACME Renewal Information (ARI): how your CA tells you when to renew](https://kirkdiamond.com/guides/acme-renewal-information-ari): ARI (RFC 9773) lets a CA set each certificate's renewal window and pull it forward before a revocation. How it works, which clients use it, how to query it. ### HTTP - [301 vs 302 vs 307 vs 308: choosing the right HTTP redirect](https://kirkdiamond.com/guides/301-vs-302-vs-307-vs-308): The four redirect codes, permanent versus temporary, why 307 and 308 exist, what browsers cache and search engines do, and which to use for HTTPS. - [HTTP security headers: what each one does and a sensible default set](https://kirkdiamond.com/guides/security-headers): HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy and the rest, one at a time, with a sensible starting configuration. - [HSTS preload: the checklist, and the ways it locks you out](https://kirkdiamond.com/guides/hsts-preload-checklist): What Strict-Transport-Security does, what preloading adds, the exact header the list requires, the subdomain trap, and a staged rollout you can back out of. - [502 vs 503 vs 504: which layer failed and how to tell](https://kirkdiamond.com/guides/502-vs-503-vs-504): Three gateway errors that look the same to a visitor but point at different failures: a bad upstream reply, a refusal, or no answer. How to tell which. - [ERR_TOO_MANY_REDIRECTS: how to find and fix a redirect loop](https://kirkdiamond.com/guides/err-too-many-redirects): A redirect loop is two layers that disagree: a proxy and the app, apex and www, slash rules or cookies. How to see the hops, find the pair and fix it. ### JWT - [JWT exp, iat and nbf claims: how token expiry actually works](https://kirkdiamond.com/guides/jwt-exp-iat-nbf): The three time claims in a JWT, their units, clock skew, why an expired token still decodes, and how to debug the token is expired error. ### HMAC - [How to verify webhook signatures with HMAC (Stripe, GitHub, Slack)](https://kirkdiamond.com/guides/how-to-verify-webhook-signatures): How HMAC-SHA256 webhook signatures are built, the raw-body mistake behind most mismatches, replay protection, and how to reproduce a signature by hand. ### Encoding - [Base64 vs Base64url: the difference, and why your JWT would not decode](https://kirkdiamond.com/guides/base64-vs-base64url): Two alphabets, one padding rule and the places each is used. What breaks when you mix them up and how to convert between them. ## Optional - [API and curl reference](https://kirkdiamond.com/api) - [Privacy](https://kirkdiamond.com/privacy) - [Terms](https://kirkdiamond.com/terms) - [About Kirk Diamond](https://kirkdiamond.com/about/)