47 Services from api.lookproof.dev

Follows a domain's HTTP-to-HTTPS redirect chain and inspects the security headers of the final HTTPS response, including HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, and cookie flags.

Retrieves domain registration details via RDAP (RFC 9083) including registrar, dates, EPP statuses, nameservers, and DNSSEC info — no contact data returned.

Returns a comprehensive single-call audit of a domain's email and DNS security posture, covering MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DNSSEC, reverse DNS, BIMI, and CAA records with coded findings per section.

Returns how strongly a domain's DMARC policy asks receivers to act on mail that fails authentication, including effective policy, subdomain policy, pct, SPF all-qualifier, and plaintext gap explanations.

Looks up and explains the DMARC record of a domain (or its organisational domain), returning policy, subdomain policy, alignment modes, reporting addresses, and coded findings about spoofing protection.

Identifies the mail hosting provider and email sending services for a domain by analyzing its MX records and SPF include tree

Checks the TLS certificate served on port 443 for a domain, returning chain trust, name match, expiry, issuer, key/signature algorithms, TLS version, and coded findings.

Checks a domain's full MTA-STS setup (RFC 8461) including DNS record, HTTPS policy file, certificate validity, MX coverage, mode, max_age, and TLS-RPT record (RFC 8460)

Probes 27 common DKIM selectors for a domain and validates each found key's type, size, revocation status, and testing flag

Parses and validates a PEM-encoded PKCS#10 certificate signing request, returning subject, SANs, key type/size, and signature validity — fully offline.

Unfolds and flattens a domain's full SPF policy into merged IPv4/IPv6 CIDR blocks by recursively following includes and redirects per RFC 7208 lookup limits

Parses a Strict-Transport-Security (HSTS) header value per RFC 6797, returning max-age, includeSubDomains, preload flags, and hstspreload.org rule compliance — offline, no DNS required.

Decodes a PEM-encoded X.509 certificate offline, returning subject, issuer, validity, SANs, key info, signature algorithm, CA flag, key usages, self-signed status, and SHA-256/SHA-1 fingerprints.

Parses a Content-Security-Policy header value offline, identifying directives, sources, unsafe flags, wildcards, and missing critical entries per CSP Level 3.

Validates a pasted DNS zone file (RFC 1035 master format) for syntax errors, structural issues, and common misconfigurations before loading

Parses and validates a pasted MTA-STS policy file (RFC 8461) offline, checking version, mode, MX patterns, max_age, and flagging non-conforming lines or risky settings.

Reads and parses HTTPS DNS records (RFC 9460 SVCB) for a domain, returning priority, target, AliasMode/ServiceMode, ALPN protocols, port, IP hints, and ECH publication status.

Evaluate a domain's CAA (Certification Authority Authorization) DNS records, climbing to parent domains if needed, to determine which CAs may issue certificates and why certificate requests may be refused.

Parses and validates a raw DMARC TXT record string offline (no DNS lookup), extracting all tags and returning structured findings with coded diagnostics.

Reports the DNSSEC validation status of a domain (secure, insecure, bogus, or unknown) including DS/DNSKEY algorithms, deprecated algorithms, SHA-1 digests, and broken chain-of-trust detection.

Convert a domain name between Unicode and punycode (ACE/A-label) and validate it against IDNA2008, UTS 46, bidi, context, hyphen, and mixed-script homograph rules per label

Runs a consolidated website security audit covering TLS certificate, HTTP redirect chains, security headers (HSTS, CSP, framing, Referrer-Policy, cookies), and domain registration status in a single call.

Parses and evaluates a domain's SPF record, tracing the full include/redirect tree, validating qualifiers, and checking against the RFC 7208 10-lookup limit with coded diagnostic findings.

Validates a domain's BIMI record syntax, logo URL, certificate URL, and DMARC enforcement status to diagnose why brand logos don't appear in email clients

Checks reverse DNS (PTR records) for a domain's MX hosts and validates full-circle reverse DNS (FCrDNS) for each mail server IP address

Fetches and validates the DKIM public key DNS record for a given domain and selector, checking key type, size, revocation status, and syntax with coded findings.

Resolve one or more DNS record types for a domain name through public resolvers, returning the answer, TTL, observation time, and which resolver responded.

Parses a raw Set-Cookie header string according to RFC 6265bis, validating Secure, HttpOnly, SameSite, Partitioned, __Host- and __Secure- prefixes, Domain, Path, Expires, and Max-Age (with the 400-day cap), returning attribute analysis but never the cookie value itself.

Classifies an IPv4 or IPv6 address against IANA special-purpose registries, returning its category, RFC reference, compressed/expanded forms, reverse DNS name, and IPv4-mapped form — all computed offline.

Returns a consolidated email authentication report for a domain covering MX, SPF, DMARC, and optionally DKIM records in a single API call.

Checks MX, SPF, and DMARC configuration for up to 20 domains in a single request, returning ordered results with retry tokens for failed checks.

Lists all domain verification tokens found in a domain's apex TXT records, identifying services like Google, Microsoft, Atlassian, Facebook, Apple, Adobe, DocuSign, and Stripe.

Lists a domain's mail servers in priority order and detects null MX (RFC 7505) or unresolvable MX targets, with coded diagnostic findings.

Checks whether a DNS zone has a wildcard record (RFC 4592) by querying A, AAAA, TXT, and MX types for a random uncached subdomain, with a warning if wildcard MX accepts mail for invented subdomains.

Queries the same DNS name and record type against both Cloudflare and Google resolvers independently (uncached) and compares their response codes and records to surface propagation issues or resolver-specific discrepancies.

Checks a domain's TLS-RPT DNS record (_smtp._tls TXT) for RFC 8460 compliance, validating the v=TLSRPTv1 version tag and rua report address format.

Computes full CIDR block details (network address, first/last host, address count, netmask, host mask, and host-bits-set flag) for any IPv4 or IPv6 CIDR notation input, entirely offline.

Identifies which DNS hosting provider (Cloudflare, Route 53, Azure DNS, Google Cloud DNS, etc.) is managing a domain's name servers by matching its NS records against a versioned pattern list.

Splits an IPv4 or IPv6 CIDR block into equal subnets of a specified longer prefix, returning up to 256 subnets in order

Checks whether a single IPv4 or IPv6 address falls within any of up to 100 CIDR blocks, returning per-block match results and the list of matching blocks.

Parses a raw SPF record string (without DNS) into mechanisms, qualifiers, modifiers, syntax errors, the 'all' policy, and DNS lookup count with coded findings per RFC 7208.

Converts a start and end IPv4 or IPv6 address into the minimal list of CIDR blocks that exactly covers that range.

Retrieves and validates a domain's SOA record through public resolvers, checking primary server, contact, serial, and all zone transfer timers against RFC 1912 and RFC 2308.

Parses a pasted TLS-RPT DNS record (RFC 8460) offline, validating the version tag, extracting the rua field, and classifying each reporting URI as mailto: or https:.

Retrieves and analyzes a domain's name server set, including NS records, IPv4/IPv6 addresses for up to eight servers, glue record needs, and DNS redundancy information.

Returns the TTL of A, AAAA, MX, NS, TXT, CAA, and SOA records for a domain, sourced from DNSSEC-validated signatures or resolver cache, plus SOA negative caching TTL.

Parses and validates a raw BIMI DNS record string offline, extracting and checking the version, logo URL, and authority certificate tags without fetching external resources.