What should we check?
My servers
Star any result to keep it here; the list stays on this device only.
All tools
GuidesEvery CheckNet check has a guide: what it is, why it matters and how to fix it, step by step.My device
…
Checks
More details
This connection
This device
This is what Cloudflare sees of this connection. Nothing is stored.
Your request headers
Speed test
Measured to the nearest Cloudflare data centre, with no other service involved. On a fast connection it uses up to about 200 MB of data.
Is it blocked?
The site is opened from networks inside the country and from outside it, next to OONI’s figures for the last month.
Does it open everywhere?
We open the site from several countries, so you can see whether it is reachable everywhere.
Port check
Timed from the Cloudflare data centre nearest to you, not from your device. Common ports only.
Ping and route
Ping tells you how far away a host is; traceroute and MTR show the path hop by hop. It runs from places around the world, not from your device.
DNS
Domain records, DNS and email health, and DNS answers from around the world.
DNS answers from around the world
Compare DNS resolvers
The same question to Cloudflare, Google, Quad9 and the domain’s own server; different answers mean a change has not reached everyone yet.
Link and headers
Follows the redirects one by one so you see where a link really goes, and shows the final site’s headers and security settings.
Domain email
Checks a domain’s mail server, SPF, DMARC, DKIM key, MTA-STS and TLS-RPT policies and BIMI logo together.
Why does email need so many records?
Email was built on trust: anyone could send mail in anyone’s name. SPF, DMARC and DKIM keys came later so a receiver can tell whether a message really comes from the domain or is forged. Without them, even real mail lands in spam.
MTA-STS tells other servers to deliver mail only over an encrypted connection, and TLS-RPT reports back when encryption fails somewhere. A BIMI logo appears next to the domain’s mail in Gmail and other apps, but only when DMARC is strict.
Network (ASN)
Who runs a network, the IP ranges it announces and the networks it connects through. Type the network number, like AS44244.
What works for me?
One button connects your device straight to these services to see which open and how fast. Open means the server answered; some services still refuse users in Iran.
Ad blockers may stop some of these requests and make that service look blocked.
Who hosts it?
Which company’s network a site sits on, which country its server is in, whether it uses a CDN, and who runs its DNS and email.
SPF and DMARC builder
Fill in the form to get a correct SPF or DMARC record, then add it in your domain’s DNS panel.
SPF record
SPF guideDMARC record
DMARC guideCSR maker and certificate converter
Make a certificate signing request (CSR) and private key right here in the browser, and convert certificates between PEM and DER. The key never leaves your device.
Make a certificate request
Convert PEM and DER
Domain info
Registrar, registration and expiry dates and name servers, from RDAP.
SSL certificate
Check a site’s certificate, or read a certificate (PEM).
Have a certificate (PEM)?
IP lookup
The network owner, country, abuse contact and reverse name (PTR) of an IP.
Encode and decode
Everything runs in this browser; nothing you type here is sent anywhere.
The signature is not checked; only the contents are shown.
Subnet calculator
Type an IP with a prefix or a mask, like 192.168.1.10/24, or a number to turn into an IP.
Speed units
Providers sell megabits per second; browsers show downloads in megabytes.
Guides
Every CheckNet check has a guide: what it is, why it matters and how to fix it, step by step.