14 Services from api.probekit.dev

Parses and evaluates a domain's SPF record, expanding include/redirect trees, checking qualifiers, and verifying compliance with RFC 7208's 10 DNS lookup limit.

Runs a comprehensive email and DNS security audit on a domain, returning MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DNSSEC, rDNS, BIMI, and CAA findings in a single call.

Resolves one or more DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV) for a given domain name via public resolvers, returning records with TTL, observation time, and the resolver used.

Checks reverse DNS (PTR records) for a domain's MX hosts and validates forward-confirmed reverse DNS (FCrDNS), flagging mismatches that cause mail rejection or spam filtering.

Fetches and validates the DKIM public key DNS record for a given domain and selector, checking key type, size, revocation status, and syntax.

Evaluates a domain's CAA records (including parent-name climbing) to determine which CAs are authorized to issue certificates, detect iodef reporting addresses, unknown critical tags, and invalid values.

Returns a single consolidated report of a domain's email authentication setup — MX, SPF, DMARC, and optional DKIM selectors — with coded findings and an overall status.

Lists a domain's mail servers in preference order and detects null MX (RFC 7505) and unresolvable MX targets with coded findings.

Validates a domain's MTA-STS policy (RFC 8461) and TLS-RPT record (RFC 8460), including DNS record presence, HTTPS policy file retrieval, certificate validity, mode, max_age, and MX host coverage.

Looks up and explains a domain's DMARC record, including policy, subdomain policy, alignment mode, and reporting addresses, with coded findings indicating spoofing protection status.

Checks MX, SPF, and DMARC records for up to 20 domains in a single request, returning results in input order with retry tokens for failures.

Checks a domain's BIMI DNS record for valid syntax, logo/certificate URLs, DMARC enforcement status, and SVG logo path to diagnose why brand logos don't appear in mail clients.

Validates a domain's DNSSEC chain of trust and reports its status (secure, insecure, bogus, or unknown) along with DS/DNSKEY algorithms, deprecated algorithms, and broken key details.

Tries 27 common DKIM selectors for a domain and validates every key found, including type, size, revocation status, and testing flag