Free tools
Twenty checks, no sign-up
The same probes that run continuously for our customers, open to everyone. Enter a domain, get the result. Nothing to create, nothing to hand over.
5 diagnostics · a verdict on a domain
- 01A domain's full health reportAll four checks at once, in a report you can forward.example.comWorth watchingOne issue out of four.Certificate expired · expiry, email and reputation are fine
- 02When does this domain expire?The date, the registrar and the name servers.example.comWorth watchingExpires in 30 days.Registrar: OVH · due on 24 September 2026
- 03Is this SSL certificate valid, and when does it expire?The expiry, the issuer, the names covered and the chain.example.comProblemCertificate expired 2 hours ago.Let's Encrypt · covers the domain and www · full chain
- 04Are your SPF, DKIM and DMARC set up right?SPF, DKIM and DMARC read from your zone, in plain language.example.comWorth watchingSPF and DKIM in place, DMARC missing.Without DMARC, your name can be spoofed in an email
- 05Is this domain or its mail server blacklisted?The domain and its IP addresses, tested against seven public lists.example.comAll clearOn none of the seven lists.Domain and IP addresses tested · last checked just now
4 DNS lookups · the contents of one record type
- 06Which servers receive mail for this domain?The servers that receive mail, in the order they are tried.example.comWorth watchingOne MX target is an alias.2 records · preferences 10 and 20 · both resolve
- 07Which nameservers answer for this domain?A domain's delegation, set against the one its registry publishes.example.comProblemOne of the two nameservers does not resolve.Registry and zone agree · 2 servers announced
- 08What do this domain's TXT records do?Every TXT record on a name, sorted by use, DMARC included.example.comProblemTwo SPF records published.9 TXT on the domain · DMARC found on _dmarc
- 09Where does this CNAME end up?A name's alias, the chain it crosses, and where it ends.www.example.comProblemThe alias points at a target that no longer exists.1 hop · no address at the end of the chain
Network and email — 4 tools
- 10Has my DNS change propagated yet?You changed an A record, an MX record, a TXT record, and nothing tells you whether it took. This tool asks eight public resolvers, then asks your zone's own name servers, and shows you which ones are still handing out the old answer.
- 11Build your SPF recordTick whoever sends email on your behalf and the record writes itself on the right. The counter follows the ten DNS lookups RFC 7208 allows for a whole check: that is what breaks real companies' records, long before syntax ever does.
- 12Is this domain blacklisted?Two questions everyone runs together, asked at once. Anti-spam blacklists decide whether your email arrives; Google Safe Browsing decides whether Chrome puts a red screen in front of your site. A domain can be spotless for one and flagged by the other.
- 13What security headers does this site send?One request, and you see everything the server tells the browser. The HSTS check and the mixed-content check sit on the same page, because between them they answer one question: is this site actually served the way it claims to be?
Certificates and names — 3 tools, no network call
- 14What is my certificate request actually asking for?The subject, the key, the requested names, and what a CA will turn down.
- 15What is inside this certificate?Names covered, dates, issuer, extensions and fingerprints.
- 16What does this domain name look like in Punycode?Both forms of a name, its real length, and any character posing as a Latin letter.
Domains and addresses — 5 tools
- 17Check when fifty domains expire, in one pastePaste your list, one domain per line. Every extension's registry gets queried, and the answer comes back as one table sorted by urgency: what has already expired sits at the top, what is fine sits at the bottom, and the dates are the registry's own — not a cached copy.
- 18Who owns this domain, and since when?Type a domain, get everything its registry publishes about it: the day it was created, the day it last changed, the day it expires, the registrar holding it, the name servers answering for it and the statuses set on it. That is the WHOIS record — read here over RDAP, the modern protocol registries actually keep current.
- 19Where does this URL actually end up?The chain gets walked one hop at a time, with nothing collapsed along the way: the status code at every step, the URL it points to next, and what that step costs in milliseconds. You pick the starting point yourself — http or https, with www or without — because those are four different front doors into the same site, and they rarely behave the same way.
- 20What is this site built with?Only what the site says about itself gets read: its response headers, its generator tag, the paths of the files its pages pull in, the names of the cookies it sets. Every line of the result comes with the exact fragment that gave it away, so you can judge the call yourself — and where there is nothing to see, the page says so rather than guessing.
- 21Is this URL open to crawlers?We read the domain's robots.txt and, if you give us a path, tell you whether a specific crawler is allowed to fetch it — along with the rule that decided, not just the raw file.
Five diagnostic tools — DNS, ports, mail headers, availability
- 22What a domain publishes: all 8 answers, in one goYou type a name, the eight questions go out together, and the zone comes back stacked: the base, the delegation, then everything hanging below it. An empty box is not an outage — we tell you which ones are normal and which ones are not.
- 23Reverse DNS: which hostname does this IP address carry?This is the only tool on the site that takes an IP address rather than a domain name — the PTR record belongs to the address. It reads that record, then walks the path back the other way: does the hostname it returns answer, in turn, for that same address? That round trip, and not the PTR record on its own, is what the servers receiving your mail look at.
- 24Is this domain name available?The answer is not in your browser and not in a ping: it is held by the registry of the extension, the only place where registered names are listed. We ask it over RDAP and hand you what it publishes — the state, the registration date, the expiry, the registrar. Nothing to buy afterwards.
- 25What does this message header say?Paste the full header and you get the servers it crossed, the time spent between each one, and whatever the receiving server wrote about SPF, DKIM and DMARC. This is reading, not checking: nothing is looked up online.
- 26Is that port really answering?We open a connection to the port, note what comes back, and close it again. Nothing is sent, no banner is read. Three answers are possible — and the third is the one nobody explains.
A check is a photograph. Monitoring is the film.
These tools tell you the state of a domain the moment you click. DomainVigil runs the same checks several times a day, on all your domains, and writes to you when something changes.
5 free domains, forever. No card required.
These tools are capped per visitor — enough to review a whole portfolio, not enough to build a service on top. The cap counts domains analysed, not clicks.