Developer & network tools,
no nonsense.

Domains & email

What the world sees when it looks up your name: DNS records, SSL/TLS certificates and mail policy.

• Domain Health checker One check across DNS, SSL/TLS, HTTP and email for a domain: address records and nameservers, certificate chain and expiry, HTTPS redirect and security headers, SPF, DKIM and DMARC. Graded, with every finding explained and a link to the full report. curl kirkdiamond.com/domain-health?domain=example.com
• DNS lookup Look up A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV and PTR records against Cloudflare, Google, Quad9 or a resolver you choose. Shows TTLs, response codes and timings, so you can check propagation. curl kirkdiamond.com/tools/dns?name=example.com
• DNS trace & propagation checker new dig +trace without the incantation: walk a name from the root servers through each delegation to the authoritative answer, then see every authoritative server's answer and serial and what Cloudflare, Google, Quad9 and OpenDNS are caching, side by side. Flags stale glue, mismatched NS sets, lame servers and resolvers still serving the old record. curl kirkdiamond.com/tools/dns-trace?name=example.com
• SSL/TLS certificate checker Connect to any host and read back the certificate chain, expiry date, SANs, key type, negotiated protocol and cipher, ALPN, OCSP stapling and which TLS versions the server still accepts. curl kirkdiamond.com/tools/tls?host=example.com
• SSL certificate chain checker new Will your certificate fail in curl, Java, Python or Android while it works in Chrome? One handshake captures the chain exactly as served and shows a verdict for 13 clients, the missing intermediate, and the fullchain.pem and server config that fix it. curl kirkdiamond.com/tools/chain?host=example.com
• Email deliverability checker SPF, DKIM, DMARC and MX in one report: MX hosts and whether they speak STARTTLS, SPF parsed as a tree with the 10-lookup and void-lookup counts (duplicates counted as receivers do, CNAME chains shown), DMARC policy decoded, DKIM keys for common selectors, MTA-STS validated and matched against the MX hosts, TLS-RPT and BIMI. curl kirkdiamond.com/tools/mail?domain=example.com

HTTP & debugging

Watch requests go in and come out. Point things at these while you debug.

• HTTP header & redirect checker Fetch a URL and see every redirect hop with its status, a timing breakdown per hop (DNS, connect, TLS, first byte, download), the final response headers, protocol and compression, and a plain-English scorecard of the security headers and cookie flags. curl kirkdiamond.com/tools/http?url=example.com
• Webhook tester & request bin A throwaway URL that records every request sent to it and shows them live. Point a webhook at it and watch it land, then replay it as curl. curl -X POST kirkdiamond.com/b/<id> -d '{"hello":1}'
• HTTP request header checker Echo every HTTP header your browser or client sent, exactly as this server received it. Handy for debugging proxies, CDNs, load balancers and User-Agent or Accept negotiation. curl kirkdiamond.com/tools/headers
• HTTP status code tester Return any HTTP status code from 200 to 599, optionally after a delay. For testing retries, timeouts, error handling and uptime monitors. curl -i kirkdiamond.com/tools/status/429

Addresses & networks

Who owns an address and how traffic reaches you.

• ASN & IP lookup Who owns an IP address: reverse DNS, origin ASN and network name, announced BGP prefix, registry country and the RIR's own RDAP record. curl kirkdiamond.com/tools/ipinfo?q=1.1.1.1
• What is my IP address Your public IPv4 or IPv6 address as the server sees it, plus any X-Forwarded-For, Forwarded or Via headers a proxy or VPN added in front of it. curl kirkdiamond.com/tools/ip

Encode & decode

Runs entirely in your browser. Nothing you paste leaves the page.

• JSON formatter, validator & viewer Paste JSON to validate it, format or minify it, browse it as a collapsible tree, edit keys and values in place and copy it back out. Runs in your browser. local only
• JWT decoder Paste a JSON Web Token and read the header, payload and expiry. Flags expired and not-yet-valid tokens. Nothing leaves your browser. local only
• Base64 & URL encoder/decoder Encode and decode Base64, Base64url and URL percent-encoding in both directions, UTF-8 safe, in your browser. local only
• Unix timestamp converter Convert Unix epoch seconds, milliseconds, microseconds or nanoseconds to ISO 8601, UTC and local time, and back. Live current timestamp and code snippets for common languages. local only
• Text & JSON diff checker Compare two blocks of text by line, word or character, side by side or unified. Ignore whitespace or case, sort JSON keys so reordering is not a change, copy the result as a patch. local only
• Hash & HMAC generator SHA-256, SHA-1, SHA-384, SHA-512, MD5 and CRC32 of text or a dropped file, HMAC with a key, hex or Base64, and a verifier that tells you which algorithm a checksum came from. local only

Guides

Short, first-hand explanations of the things these tools show you. All guides.

• NXDOMAIN vs SERVFAIL: what each DNS error means and how to fix itThe two DNS response codes you will actually meet in production, what causes each, how to tell them apart in dig and a resolver comparison, and what to change.
• How long does DNS propagation take? TTLs, caches and how to checkDNS does not propagate, caches expire. What actually decides how quickly a record change is seen, how to plan a cutover, and how to check individual resolvers.
• The SPF 10 DNS lookup limit: why it breaks and how to fix itWhat counts towards the SPF lookup limit, why one more SaaS provider silently turns SPF off, and the options for getting back under ten lookups.
• DMARC p=none vs quarantine vs reject: which policy to use and when to moveWhat each DMARC policy tells receivers, why nearly everyone should start at none, how to read the reports and when to move to quarantine, then reject.
• SSL certificate chains explained: leaf, intermediate, root and the missing intermediate problemWhat a certificate chain is, why the server sends the intermediates and the client supplies the root, and the chain faults that break real deployments.
• 301 vs 302 vs 307 vs 308: choosing the right HTTP redirectThe four redirect codes, permanent versus temporary, why 307 and 308 exist, what browsers cache and search engines do, and which to use for HTTPS.
• HTTP security headers: what each one does and a sensible default setHSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy and the rest, one at a time, with a sensible starting configuration.
• JWT exp, iat and nbf claims: how token expiry actually worksThe three time claims in a JWT, their units, clock skew, why an expired token still decodes, and how to debug the token is expired error.
• How to verify webhook signatures with HMAC (Stripe, GitHub, Slack)How HMAC-SHA256 webhook signatures are built, the raw-body mistake behind most mismatches, replay protection, and how to reproduce a signature by hand.
• Base64 vs Base64url: the difference, and why your JWT would not decodeTwo alphabets, one padding rule and the places each is used. What breaks when you mix them up and how to convert between them.
• SPF PermError: what causes it and how to fix itToo many DNS lookups, two records, a syntax slip or a dead include. What SPF PermError means to receivers, how to find your cause, and the fix for each.
• SPF vs DKIM vs DMARC: what each one proves and why you need all threeSPF checks the sending server, DKIM the message, DMARC what happens when they disagree with the From address. The gaps in each and how they fit together.
• MTA-STS explained: forcing TLS on inbound mail without breaking deliveryWhy STARTTLS alone can be stripped, what an MTA-STS policy tells senders, the record and policy file, testing versus enforce, and TLS-RPT reports.
• CNAME vs A record, and why a CNAME at the apex failsWhen to point a name at an address and when to alias it, what a CNAME drags along, why the zone apex cannot be one, and what ALIAS and flattening do.
• CAA records: how they block the wrong CA and how they break renewalsWhat a CAA record tells a certificate authority, the issue, issuewild and iodef tags, and the renewal failure that appears months after someone adds one.
• TLS 1.2 vs TLS 1.3: what changed and what to switch offThe round trip saved, the cipher suites that went away, why forward secrecy is no longer optional, what still needs 1.2, and how to check a server.
• HSTS preload: the checklist, and the ways it locks you outWhat Strict-Transport-Security does, what preloading adds, the exact header the list requires, the subdomain trap, and a staged rollout you can back out of.
• 502 vs 503 vs 504: which layer failed and how to tellThree gateway errors that look the same to a visitor but point at different failures: a bad upstream reply, a refusal, or no answer. How to tell which.
• Why your SSL certificate works in Chrome but fails in curl, Java, Python and AndroidBrowsers fetch the intermediate your server forgot to send; curl, Python, Java and Android do not. Why it hides in testing, each client's error, and the fix.
• unable to get local issuer certificate: what it means and how to fix itOpenSSL error 20 has two causes: the server did not send its intermediate, or your trust store lacks the root. How to tell them apart and fix each.
• How to build a correct fullchain.pem for nginx, Apache, HAProxy and load balancersLeaf first, then intermediates, no root. Build fullchain.pem from certbot or a CA's zip, verify it, and see where nginx, Apache, HAProxy and clouds want it.
• MTA-STS max_age and the policy cache: why mail bounced a week after you changed MXSenders cache your MTA-STS policy for max_age seconds, so an MX migration can bounce mail a week later. The safe order of changes and what max_age to pick.
• SSL_ERROR_BAD_CERT_DOMAIN and ERR_CERT_COMMON_NAME_INVALID: the certificate is for another nameFirefox and Chrome refuse a certificate that does not list the name you asked for. How to tell a wrong default certificate from a missing SAN, and fix each.
• certificate has expired and ERR_CERT_DATE_INVALID: which certificate, and whyThe leaf, an intermediate or the client's clock: how to tell which one expired, why renewals fail silently, and how to monitor certificate expiry from CI.
• self-signed certificate in certificate chain: what it means for npm, pip, git and curlWhy npm, pip, git and curl fail while the browser works: a corporate proxy or a private CA. How to tell which, and how to add the root without disabling checks.
• ERR_TOO_MANY_REDIRECTS: how to find and fix a redirect loopA redirect loop is two layers that disagree: a proxy and the app, apex and www, slash rules or cookies. How to see the hops, find the pair and fix it.
• DKIM body hash did not verify: what changed the message and how to find itBody hash did not verify means the message changed after signing: a list footer, a gateway disclaimer or re-encoding. How to find what touched it.
• 550 5.7.26 unauthenticated email: how to pass the Gmail and Yahoo sender rulesGmail's 5.7.26 bounce means SPF, DKIM or DMARC alignment failed. The two variants, what Gmail and Yahoo require of senders, and how to find the cause.