Blog / friday roundup
Seven free tools for checking your DNS and email
Seven free tools we use every day to diagnose DNS records, mail delivery, and certificates, and the exact question each one answers.
Another Friday, another list. This time it's the free tools we reach for every single day when someone tells us "my email isn't arriving" or "my domain isn't working." None of these are new or obscure. That's the point: they're the boring, dependable instruments we trust, and every one of them costs nothing.
The trick with diagnostic tools is knowing which question each one answers. So that's how we've organized this.
Looking up what DNS actually says
dig and nslookup
The command-line originals. When a customer and we disagree about what a DNS record says, dig settles it. It shows the raw answer from a nameserver, including the TTL, which tells you how long old values will keep floating around. nslookup does the same job on Windows machines where dig isn't installed. Question answered: what does this nameserver return for this record, right now?
MXToolbox
The Swiss Army knife of the browser-based options, and probably the tool we link customers to most often. MX lookup, blacklist checks, SMTP tests, SPF parsing, all in one place. When a customer's mail is bouncing, our first move is usually their blacklist check. Question answered: is there something publicly wrong with this domain's mail setup?
DNS propagation checkers
Sites like whatsmydns.net query your record from dozens of locations around the world at once. After a nameserver change or a hosting move, this is how you watch the new values spread. We see people panic two hours after a DNS change because their office still sees the old site; a propagation checker usually shows the rest of the world already moved on. Question answered: has my change reached everyone yet?
Checking that email will actually deliver
Google Admin Toolbox
Google's own dig-in-a-browser plus a very good MX and mail-flow checker. Because so much of the world's inbound mail lands at Google, seeing your domain the way Google's tooling sees it is worth a lot. We use its Check MX feature when a customer says "Gmail users can't receive my mail." Question answered: does my mail setup look sane to the biggest inbox provider?
Mail deliverability scorers
Tools in the mail-tester mould give you a throwaway address, you send one message to it, and you get back a scored report: SPF, DKIM, DMARC alignment, blacklists, and whether your content looks spammy. The three authentication records deserve their own article someday, but the short version is that mail without them is mail on probation. If your score is low, the report tells you exactly which record to fix. Question answered: why would a spam filter distrust this message?
The paperwork layer
whois
Old as the web, still essential. whois tells you who registered a domain, when it expires, and which nameservers it's delegated to. A shocking number of "my site vanished" tickets turn out to be an expired domain, and whois shows that in five seconds. Question answered: is this domain registered, current, and pointed where its owner thinks it is?
Certificate checkers
Let's Encrypt made certificates free; checkers like the ones built into your browser (click the padlock) or SSL testing sites tell you whether the certificate is valid, what names it covers, and when it expires. When someone reports a security warning on their site, we check the certificate's covered names first, because www versus non-www mismatches cause half of these tickets. Question answered: is this certificate valid for the exact name visitors are typing?
None of these tools fix anything. They tell you where to look, which is most of the battle. If you run business email with us and a tool on this list is showing you something you don't like, send the report to support with your ticket; a diagnostic screenshot saves everyone a day of back and forth.