All tools
Every tool on OrbitProbe, grouped by what it looks at. All of them run live lookups against public sources and say where each answer came from; the generators and the header analyzer run entirely in your browser.
Domain
Who a domain is registered with, since when and until when, which host names exist, and how several domains compare.
Domain report
Enter a domain and get registration data, DNS records, mail configuration, hosting network and the TLS certificate on one page, in 5 sections. Every section is fetched live and shows where the data came from and when.
WHOIS
Check who a domain is registered through, when it was created, when it expires and what its status codes mean. Data is read live from the registry's RDAP service, the modern replacement for WHOIS, or from port-43 WHOIS where a registry has no RDAP.
Domain age
Find out when a domain was first registered, how old it is today, and when it was last updated and will expire.
Subdomain finder
List up to 500 hostnames of a domain that appear in public Certificate Transparency logs: a quick inventory of what has been given a TLS certificate.
Bulk domain lookup
Paste up to 25 domains. Each one is checked live and lands in one table: registrar, expiry, nameservers, mail setup and certificate expiry, with CSV export.
Compare domains
Put two domains next to each other: registration, DNS, mail, hosting and certificate. Every row is marked as same, different or could not be checked.
DNS
What the DNS says about a name or an address, whether the zone is signed, and whether a change has reached public resolvers.
DNS lookup
Query 8 DNS record types (A, AAAA, CNAME, NS, MX, TXT, CAA, SOA) of any domain or hostname and see values and TTLs as public resolvers return them right now.
NS lookup
See which nameservers answer for a domain, and whether the NS records in DNS agree with the delegation held at the registry.
DNS propagation
Changed an A record, moved nameservers or updated MX? Ask 10 independent public resolvers for the same record at once and see which ones already return the new value.
IP & hosting
Resolve a domain to its IP addresses (up to 4 IPv4 and 2 IPv6) and see the reverse DNS name, the autonomous system and the network owner for each one.
Reverse DNS lookup
Enter an IP address, or a domain to look up its addresses first (up to 8). You get the PTR name of each address and whether that name resolves back to the same address.
DNSSEC checker
See whether a domain is signed: the DS records at the parent zone, the DNSKEY records in the zone itself, and whether two validating resolvers marked the answer as authenticated.
Whether a domain can receive mail, whether the mail it sends can be authenticated, and tools to build the records.
MX lookup
See which mail servers accept email for a domain, with the first 5 resolved to their addresses, and whether its SPF and DMARC records are present and well formed.
SPF checker
Look up the SPF record of a domain and see the problems that most often break it: more than one record, +all, no all mechanism, or more than 10 DNS lookups.
DKIM checker
Look up the DKIM public key a domain publishes for a selector, or try 32 default selectors of common mail providers, and see whether the key parses, how long it is and whether it is revoked.
DMARC checker
Look up the DMARC record of a domain, see which of the 3 policies (none, quarantine, reject) it publishes and whether the record is missing, duplicated or invalid.
SPF generator
Pick your mail providers, add your own servers and copy a valid SPF record. The 10-lookup limit and the 255-character string length are checked as you type. Nothing is sent to a server.
Runs in your browser
DMARC generator
Choose one of 3 policies, add the address that should receive reports and copy the TXT record for _dmarc.<your domain>. Everything runs in your browser.
Runs in your browser
MTA-STS checker
Look up the _mta-sts TXT record, fetch the policy file over HTTPS, compare its mx patterns with the MX hosts the domain really publishes and check max_age against the 31,557,600-second limit.
TLS-RPT checker
Check the SMTP TLS Reporting record (RFC 8460) at _smtp._tls.<domain>: the version tag and every rua address that reports are sent to.
BIMI checker
Look up the BIMI record, test that the logo URL is served over HTTPS as an SVG (logos over 32 KB are flagged), and see whether the domain enforces DMARC, which BIMI depends on.
Email header analyzer
Paste the raw headers of a message (up to 200,000 characters) to see the route it took, where it waited, and what the receiving server concluded about SPF, DKIM and DMARC. The headers never leave your browser.
Runs in your browser
Web
Whether the website answers, what it sends back, where it redirects, and how it can be reached about security issues.
Website status
Request a website live and see whether it answers within 7 seconds, how fast, with which HTTP status, which server software, and what title and description the page declares.
SSL checker
Connect to a domain over HTTPS and inspect the certificate it presents: who issued it, when it expires (flagged from 21 days out), which names it covers and whether the chain is trusted.
HTTP headers
See exactly which response headers a website sends: server and caching headers, cookie attributes, and up to 6 security headers browsers act on.
Redirect checker
Follow a domain from the first request to the final page (up to 4 redirects) and see every redirect on the way, with its status code and destination.
security.txt checker
Fetch /.well-known/security.txt from a site and check it against RFC 9116: required fields, the expiry date, HTTPS and whether the file is signed.