# middle.network > We get in the middle, so you don’t have to. 65 free tools for DNS, email authentication (SPF, DKIM, DMARC), websites, SSL/TLS, networks (ping, traceroute, MTR, ports), WHOIS and IP addresses. Every result is given in plain English and in technical detail, with fixes. Tests run from middle.network’s own probe locations in regions around the world (live list: https://middle.network/status/). No sign-up. ## Start here - [Domain health check](https://middle.network/health-check/): every DNS, email, web, TLS, network and ownership check on a domain at once, ranked, with fixes. - [What is my IP?](https://middle.network/what-is-my-ip/): your public IPv4 and IPv6, provider and approximate location. - [Service status](https://middle.network/status/): live status of every probe location and the testing API. ## Short links Each one redirects to the page named. Add a domain to fill it in, e.g. https://dns.middle.network/example.com. - https://whois.middle.network/ → https://middle.network/ownership/whois-lookup/ - https://rdap.middle.network/ → https://middle.network/ownership/whois-lookup/ - https://ipwhois.middle.network/ → https://middle.network/ownership/ip-whois-lookup/ - https://asn.middle.network/ → https://middle.network/network/asn-lookup/ - https://geoip.middle.network/ → https://middle.network/ownership/ip-location/ - https://myip.middle.network/ → https://middle.network/what-is-my-ip/ - https://dns.middle.network/ → https://middle.network/dns/dns-lookup/ - https://propagation.middle.network/ → https://middle.network/dns-health/dns-propagation/ - https://dnssec.middle.network/ → https://middle.network/dns-health/dnssec-checker/ - https://subdomains.middle.network/ → https://middle.network/dns/subdomain-finder/ - https://spf.middle.network/ → https://middle.network/email-authentication/spf-checker/ - https://dkim.middle.network/ → https://middle.network/email-authentication/dkim-checker/ - https://dmarc.middle.network/ → https://middle.network/email-authentication/dmarc-checker/ - https://bimi.middle.network/ → https://middle.network/email-authentication/bimi-checker/ - https://blacklist.middle.network/ → https://middle.network/email-delivery/blacklist-check/ - https://ssl.middle.network/ → https://middle.network/ssl-tls/ssl-checker/ - https://tls.middle.network/ → https://middle.network/ssl-tls/ssl-checker/ - https://headers.middle.network/ → https://middle.network/website/security-headers/ - https://tech.middle.network/ → https://middle.network/website/website-technology-checker/ - https://down.middle.network/ → https://middle.network/website/is-it-down/ - https://ping.middle.network/ → https://middle.network/network/ping/ - https://traceroute.middle.network/ → https://middle.network/network/traceroute/ - https://ports.middle.network/ → https://middle.network/network/port-checker/ - https://health.middle.network/ → https://middle.network/health-check/ - https://check.middle.network/ → https://middle.network/health-check/ - https://audit.middle.network/ → https://middle.network/domain-audit/ - https://security.middle.network/ → https://middle.network/domain-security-audit/ - https://iso27001.middle.network/ → https://middle.network/iso-27001-domain-compliance-check/ - https://soc2.middle.network/ → https://middle.network/soc-2-domain-security-check/ - https://compliance.middle.network/ → https://middle.network/cyber-security-compliance-check/ - https://guides.middle.network/ → https://middle.network/guides/ ## Compliance and audit - [Domain audit](https://middle.network/domain-audit/): Audit any domain in under a minute: DNS, nameservers, SPF, DKIM, DMARC, SSL, security headers, open ports, blocklists and registration, ranked by what to fix first. - [Domain security audit](https://middle.network/domain-security-audit/): Free external security audit of a domain: email spoofing protection (DMARC), TLS and certificates, DNSSEC, security headers, open ports and blocklist reputation. - [ISO 27001 domain compliance check](https://middle.network/iso-27001-domain-compliance-check/): Check a domain against ISO/IEC 27001:2022 Annex A controls you can evidence from outside: A.5.14 information transfer, A.8.24 cryptography, A.8.20 networks security, A.8.9 configuration and more. - [SOC 2 domain security check](https://middle.network/soc-2-domain-security-check/): External evidence for SOC 2 common criteria: encryption in transit (CC6.7), boundary protection (CC6.6), configuration monitoring (CC7.1) and availability (A1.2), from one domain check. - [Cyber security compliance check](https://middle.network/cyber-security-compliance-check/): One external check of a domain, mapped to ISO 27001:2022, SOC 2 and NIST CSF 2.0: email authentication, encryption, DNS integrity, exposed services, reputation and ownership. ## Guides for auditors - [ISO 27001:2022 evidence you can collect from outside the network](https://middle.network/guides/iso-27001-external-evidence/): A practical guide for ISO 27001 auditors: the Annex A 2022 controls whose effect is visible from the internet (A.5.14, A.8.24, A.8.20, A.8.9, A.5.9), what good looks like and how to collect dated evidence. - [Auditing email authentication: SPF, DKIM and DMARC explained for auditors](https://middle.network/guides/email-authentication-for-auditors/): An auditor’s guide to SPF, DKIM and DMARC: what each one proves, how to read the records, the findings that matter (p=none, too many lookups, missing DKIM), and how they map to ISO 27001 A.5.14. - [TLS and certificate evidence for ISO 27001 A.8.24 and SOC 2 CC6.7](https://middle.network/guides/tls-evidence-a824/): How auditors can evidence encryption in transit: TLS protocol versions, certificate expiry and renewal, HSTS, and certificate transparency, mapped to ISO 27001 A.8.24 and SOC 2 CC6.7. - [The ten-minute external security review: a checklist for auditors](https://middle.network/guides/outside-in-evidence/): A repeatable ten-minute external review for auditors and third-party risk teams: domains, email, TLS, exposed services, reputation and ownership, with what to record and how to word findings. - [DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy](https://middle.network/guides/dns-domain-controls/): Why the domain name is a critical asset: auditing registration and expiry, registrar transfer lock, DNSSEC, CAA and nameserver redundancy against ISO 27001 A.5.9, A.5.19, A.8.14 and A.8.24. ## Full reports Start here when you want the whole picture. A report runs many tools together, ranks what is broken, and tells you what to fix first. - [Domain health check](https://middle.network/health-check/): One free check of a domain’s DNS, email security (SPF, DKIM, DMARC), website, SSL certificate, network and registration, with fixes in plain English. - [Domain report](https://middle.network/reports/domain-report/): A one-page domain report: registrar and expiry, DNS health, DNSSEC, email score, website, certificate, security headers, technology, network and location. - [Domain email score](https://middle.network/reports/email-score/): Score a domain’s email setup out of 100: MX, SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT, with the fixes that raise the score most. ## DNS records DNS is the internet’s address book. These tools show what a domain’s records say right now and what each one does. - [DNS lookup](https://middle.network/dns/dns-lookup/): Free DNS lookup for A, AAAA, CNAME, MX, NS, TXT, CAA and SOA records, with a plain-English explanation of each record type. - [Single DNS record lookup](https://middle.network/dns/dns-record-lookup/): Look up one DNS record type for a domain and see the answer, TTL, response code and resolver timing. - [Reverse DNS lookup](https://middle.network/dns/reverse-dns/): Find the PTR record for an IP address and check that it points back (forward-confirmed reverse DNS), which mail servers rely on. - [Subdomain finder](https://middle.network/dns/subdomain-finder/): Find a domain’s live subdomains from certificate transparency logs and common names, and spot dangling CNAMEs that can be taken over. - [Zone pre-check for new nameservers](https://middle.network/dns/zone-precheck/): Before moving DNS, ask the new nameservers directly and compare their answers with the live zone so nothing breaks when you switch. - [Zone file formatter and linter](https://middle.network/dns/zone-file-formatter/): Paste a BIND zone file to validate it, catch common mistakes like missing dots and CNAME conflicts, and get a tidy, aligned version. ## DNS health and propagation Changed a record and waiting? These tools show who sees the new value, who still has the old one, and whether your nameservers are healthy. - [DNS propagation checker](https://middle.network/dns-health/dns-propagation/): Check DNS propagation across public resolvers. See who has the new value, who still caches the old one, and whether differences are just a CDN. - [Authoritative vs cached DNS](https://middle.network/dns-health/authoritative-vs-cached-dns/): Ask a domain’s own nameservers and compare with what public resolvers have cached, to see exactly how stale each cache is. - [DNS health report](https://middle.network/dns-health/dns-health-check/): Test every authoritative nameserver for a domain: does it answer, do SOA serials match, is it lame or slow, and are they on separate networks. - [DNSSEC checker](https://middle.network/dns-health/dnssec-checker/): Check whether a domain is signed with DNSSEC, whether the DS record at the registry matches its DNSKEY, and which algorithms are used. - [DNS resolver speed test](https://middle.network/dns-health/dns-resolver-speed-test/): Compare how fast Google, Cloudflare, Quad9 and other public resolvers answer for a domain, both from cache and uncached. ## Email authentication Email authentication proves your messages really come from you. Get it right and you land in the inbox; get it wrong and you land in spam, or someone sends as you. - [SPF record checker](https://middle.network/email-authentication/spf-checker/): Check a domain’s SPF record, expand every include, count DNS lookups against the limit of 10 and find void lookups and syntax errors. - [DKIM checker](https://middle.network/email-authentication/dkim-checker/): Look up a domain’s DKIM keys at common selectors or your own, and check the key type, size and whether it is revoked or in test mode. - [DMARC checker](https://middle.network/email-authentication/dmarc-checker/): Check a domain’s DMARC record: policy, percentage, alignment, subdomain policy and where reports go, with advice on moving to enforcement. - [BIMI checker](https://middle.network/email-authentication/bimi-checker/): Check a domain’s BIMI record, the SVG logo and certificate (VMC), and whether DMARC is strict enough for inboxes to show it. - [MTA-STS checker](https://middle.network/email-authentication/mta-sts-checker/): Check a domain’s MTA-STS record and policy file: mode, max age, and whether the listed MX hosts match the real mail servers. - [TLS-RPT checker](https://middle.network/email-authentication/tls-rpt-checker/): Check a domain’s TLS-RPT record, which asks other mail servers to report failed encrypted deliveries to you. - [DANE / TLSA checker](https://middle.network/email-authentication/dane-tlsa-checker/): Check DANE TLSA records for a domain’s mail servers and whether the MX records are signed with DNSSEC. - [SPF, DMARC, DKIM and BIMI record generator](https://middle.network/email-authentication/spf-dmarc-generator/): Generate valid SPF, DMARC, DKIM, BIMI and MTA-STS DNS records from simple settings, ready to copy into your DNS provider. ## Email delivery and reputation When email bounces, goes missing or lands in spam, these tools trace where it goes and how receivers see you. - [MX lookup](https://middle.network/email-delivery/mx-lookup/): Look up a domain’s MX records in priority order, with each mail server’s addresses, reverse DNS and common mistakes like CNAME targets. - [SMTP test](https://middle.network/email-delivery/smtp-test/): Connect to a domain’s mail server, read the banner, test STARTTLS and check the certificate on the submission ports. - [Email blacklist check](https://middle.network/email-delivery/blacklist-check/): Check an IP address or domain against major DNS blacklists (DNSBLs) like Spamhaus and Barracuda, with what each listing means. - [Bulk sender compliance check](https://middle.network/email-delivery/bulk-sender-compliance/): Check a domain against the Gmail, Yahoo and Microsoft bulk sender rules: SPF, DKIM, DMARC, reporting and the ability to receive replies. - [Email header analyser](https://middle.network/email-delivery/email-header-analyzer/): Paste email headers to see every server the message passed through, the delay at each hop, and the SPF, DKIM and DMARC results. - [DMARC report analyser](https://middle.network/email-delivery/dmarc-report-analyzer/): Paste a DMARC aggregate report to see who sends as your domain, how much passes, and which sources fail SPF and DKIM. ## Website and HTTP Is it down, slow, insecure or misconfigured? These tools look at a website the way a browser and a search engine do. - [HTTP check](https://middle.network/website/http-check/): Load a URL from our probes and see the status code, IP, protocol and a timing breakdown: DNS, connect, TLS and time to first byte. - [Is it down?](https://middle.network/website/is-it-down/): Check if a website is down for everyone or just you, from our servers, with the status code and response time. - [Geoblock checker](https://middle.network/website/geoblock-checker/): Load a URL from test locations on every continent and see which countries get the page, and which are blocked, redirected, bot-checked or shown something else, with the reason for each. - [Redirect checker](https://middle.network/website/redirect-checker/): Trace every redirect hop from a URL to the final page with status codes and timing, and catch loops, long chains and missing HTTPS. - [Security headers check](https://middle.network/website/security-headers/): Grade a website’s HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) from A to F with fixes. - [Website speed test](https://middle.network/website/website-speed-test/): Measure a page’s load timing and weight: HTML size, compression, the number of scripts, styles and images, and the heaviest assets. - [HTTP/2, HTTP/3 and IPv6 support](https://middle.network/website/http2-http3-ipv6-test/): Check whether a website supports HTTP/2, HTTP/3 (QUIC) and IPv6, using ALPN, Alt-Svc, HTTPS DNS records and AAAA records. - [What’s that site running?](https://middle.network/website/website-technology-checker/): Find out what a website is built with: CDN, hosting, server, CMS, framework, JavaScript libraries, fonts, analytics, ad pixels, chat and payments, plus the email and business apps its DNS reveals. Every result shows the clue that gave it away. - [robots.txt, sitemap and llms.txt checker](https://middle.network/website/robots-txt-sitemap-checker/): Check a site’s robots.txt, sitemap.xml, llms.txt and security.txt: which crawlers and AI bots are blocked and whether sitemaps are valid. - [Sitemap validator and inspector](https://middle.network/website/sitemap-validator/): Download and validate a sitemap.xml against the sitemaps.org rules, follow sitemap index files, see what it contains, and catch XXE, script and injection risks. - [Meta tag and broken link checker](https://middle.network/website/meta-tag-checker/): Preview how a page looks in Google and on social media, check its title, description, canonical and Open Graph tags, and find broken links. ## Certificates and TLS The padlock depends on a valid certificate and a modern TLS setup. These tools check both and warn you before anything expires. - [SSL certificate checker](https://middle.network/ssl-tls/ssl-checker/): Check a website’s SSL/TLS certificate: days until expiry, issuer, chain, name match, supported TLS versions and CAA records. - [Certificate transparency search](https://middle.network/ssl-tls/certificate-transparency-search/): Search certificate transparency logs for every SSL certificate issued for a domain, by which authority, and compare with your CAA policy. - [Certificate and CSR decoder](https://middle.network/ssl-tls/certificate-decoder/): Paste a PEM certificate, chain or certificate signing request (CSR) to read its names, issuer, dates, key and signature. ## Network and routing When something is unreachable or slow, these tools show whether packets get there, how long they take and where they stop. - [Ping test](https://middle.network/network/ping/): Ping any host or IP from our probe servers to measure round-trip time (latency) and packet loss. - [TCP ping](https://middle.network/network/tcp-ping/): Measure how long a TCP connection to a port takes (like ping, but works through firewalls that block ICMP). - [Traceroute](https://middle.network/network/traceroute/): Run a traceroute from our servers to see each network hop to a host, with round-trip times and the network (ASN) that owns each hop. - [TCP traceroute](https://middle.network/network/tcp-traceroute/): Trace the route to a host using TCP packets on a port such as 443, which firewalls allow when they block normal traceroute. - [MTR (My Traceroute)](https://middle.network/network/mtr/): Run MTR to a host: a traceroute that pings every hop repeatedly to show packet loss, average latency and jitter along the path. - [Port checker](https://middle.network/network/port-checker/): Check whether TCP ports on a host are open, closed or blocked by a firewall, from our servers on the internet. - [Port scanner](https://middle.network/network/port-scanner/): Scan a host for 20 common open ports and flag risky services exposed to the internet, like Remote Desktop, SMB and databases. - [MTU and path MTU test](https://middle.network/network/mtu-test/): Find the path MTU to a host: the largest packet that gets through without fragmenting, to diagnose VPN and tunnel problems. - [BGP / ASN lookup](https://middle.network/network/asn-lookup/): Find the autonomous system (ASN), network name, prefix and country for an IP, domain or AS number, and check its RPKI route validity. - [Browser network test](https://middle.network/network/browser-network-test/): See your connection from the outside: public IP, ISP, location, latency to our server and any proxy we can detect. ## Domain and IP ownership Who owns it, where is it, and how old is it? These tools read the official registries (RDAP and WHOIS) and IP data. - [WHOIS lookup](https://middle.network/ownership/whois-lookup/): Look up a domain’s registration via RDAP: registrar, creation and expiry dates, status codes, nameservers and DNSSEC. - [IP WHOIS lookup](https://middle.network/ownership/ip-whois-lookup/): Look up who owns an IP address range via RDAP: organisation, network name, country, CIDR and the abuse contact. - [Domain age and expiry checker](https://middle.network/ownership/domain-age-checker/): Find how old a domain is and when it expires, with a warning if renewal is due soon. - [Domain availability check](https://middle.network/ownership/domain-availability/): Check whether a domain name is registered or available, straight from the registry via RDAP or WHOIS. - [IP geolocation lookup](https://middle.network/ownership/ip-location/): Find the approximate country and city of an IP address, on a map, with the network (ASN) that owns it. - [Reverse IP lookup](https://middle.network/ownership/reverse-ip-lookup/): Find other domains hosted on the same IP address, plus its reverse DNS name, to spot shared hosting and CDNs. - [What is my IP address?](https://middle.network/what-is-my-ip/): See your public IPv4 and IPv6 addresses, internet provider, approximate location on a map, and connection details. ## Converters and calculators Small, fast helpers for everyday network maths and decoding. Most run instantly. - [Subnet calculator](https://middle.network/converters/subnet-calculator/): Calculate a subnet from CIDR: network address, broadcast, first and last host, netmask, wildcard and number of hosts. IPv4 and IPv6. - [IP address converter](https://middle.network/converters/ip-converter/): Convert an IP address between dotted, decimal, hex and binary, and between IPv4 and IPv4-mapped IPv6. - [Punycode and IDN converter](https://middle.network/converters/punycode-converter/): Convert international domain names to and from punycode (xn--) and spot look-alike characters used in phishing. - [MAC address vendor lookup](https://middle.network/converters/mac-address-lookup/): Look up the manufacturer of a network device from its MAC address (OUI), and see if the address is random or locally administered. - [Base64, URL and JWT decoder](https://middle.network/converters/base64-jwt-decoder/): Decode or encode Base64, URL percent-encoding and hex, and decode JSON Web Tokens (JWT) to read the header, claims and expiry. - [Timestamp and TTL converter](https://middle.network/converters/timestamp-converter/): Convert Unix timestamps to dates (UTC and Sydney time) and back, and turn TTL seconds into hours and days.