Definitions of 61+ DNS, email authentication, SSL and web security terms — with links to the relevant tools.
An A (Address) record is a DNS record type that maps a domain name to an IPv4 address. It is the most fundamental DNS record — when a browser resolves a domain, it performs an A record lookup to find the web server's IP address. A single domain can have multiple A records for load balancing.
A Record Lookup →An AAAA record maps a domain name to an IPv6 address — the 128-bit successor to the 32-bit IPv4 address used in A records. Publishing both A and AAAA records (dual-stack) ensures your domain is reachable over both IPv4 and IPv6 networks.
AAAA Record Lookup →Anycast is a network routing technique where multiple servers share the same IP address. DNS resolvers such as Cloudflare (1.1.1.1) and Google (8.8.8.8) use Anycast to route your query to the geographically nearest server, reducing latency.
An authoritative nameserver holds the official DNS records for a domain and provides definitive answers to DNS queries. When a recursive resolver finds the nameserver responsible for a domain, it queries that authoritative server for the requested record type.
NS Lookup →BIMI (Brand Indicators for Message Identification) is an email standard that displays a brand's logo next to authenticated messages in the inbox. It requires DMARC enforcement (p=quarantine or p=reject) and a DNS TXT record at default._bimi.domain pointing to an SVG logo file.
BIMI Checker →An email blacklist (Real-time Blackhole List, RBL) is a database of IP addresses and domains known to send spam. Mail servers query these lists to decide whether to accept or reject incoming email. Common blacklists include Spamhaus, Barracuda, and SURBL.
A CAA (Certification Authority Authorization) record specifies which Certificate Authorities (CAs) are permitted to issue SSL/TLS certificates for a domain. CAs must check CAA records before issuing a certificate and refuse if they are not listed. CAA records reduce the risk of misissued certificates.
CAA Record Checker →A Certificate Authority is a trusted organisation that issues SSL/TLS certificates after verifying the identity of the applicant. Browsers and operating systems include a list of trusted CAs. Common CAs include Let's Encrypt, DigiCert, Sectigo, and GlobalSign.
SSL Checker →A cipher suite is a combination of algorithms used during a TLS connection for key exchange, authentication, bulk encryption, and message authentication. Modern recommendations include suites using ECDHE for key exchange and AES-GCM or ChaCha20-Poly1305 for encryption, providing forward secrecy.
SSL Checker →A CNAME (Canonical Name) record creates an alias from one domain name to another. Instead of pointing to an IP address directly, it points to another domain (e.g. www.example.com CNAME example.com). CNAMEs cannot be used at the zone apex (root domain).
CNAME Lookup →Content Security Policy is an HTTP response header that controls which resources (scripts, stylesheets, images, fonts) a browser is permitted to load for a page. CSP is one of the most effective defences against cross-site scripting (XSS) attacks by preventing execution of unauthorised scripts.
CSP Analyzer →Cookie security attributes control how browsers handle cookies. Key attributes: Secure (only sent over HTTPS), HttpOnly (not accessible via JavaScript, preventing XSS theft), SameSite (controls cross-site sending to prevent CSRF). Combining all three provides strong protection for session cookies.
Cookie Security Checker →DKIM is an email authentication standard that allows senders to sign outgoing email with a private key. The corresponding public key is published in a DNS TXT record. Receiving mail servers verify the signature to confirm the email was sent by an authorised server and was not modified in transit.
DKIM Checker →DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to define how receiving servers should handle messages that fail authentication. Published as a DNS TXT record at _dmarc.domain, it supports three policies: p=none (monitor), p=quarantine (spam folder), and p=reject (discard).
DMARC Checker →DMARC alignment requires that the domain in the message's From header matches the domain authenticated by SPF (envelope sender) or DKIM (d= tag). Relaxed alignment allows subdomain matches; strict alignment requires exact matches. At least one mechanism must align for DMARC to pass.
DMARC Checker →The Domain Name System is the distributed hierarchical naming system that translates human-readable domain names (example.com) into machine-readable IP addresses (93.184.216.34). DNS operates through a hierarchy: root servers → TLD servers (e.g. .com) → authoritative nameservers for each domain.
DNS Lookup →DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that responses are authentic and unmodified. DNSSEC creates a chain of trust from the root DNS zone down to individual domain records. It prevents DNS cache poisoning but does not encrypt DNS traffic.
DNSSEC Checker →DNS-over-HTTPS encrypts DNS queries by sending them over HTTPS to a DoH resolver. Unlike traditional DNS which uses UDP port 53 in plaintext, DoH protects query privacy from network observers. Major providers include Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9).
DNS propagation is the time it takes for DNS record changes to spread across all DNS resolvers worldwide after being updated on the authoritative nameserver. Propagation time depends primarily on the record's TTL — resolvers cache old values until the TTL expires, then fetch fresh data.
DNS Propagation Checker →DNS TTL is the number of seconds that DNS resolvers are allowed to cache a DNS record before re-querying the authoritative nameserver. A TTL of 3600 means resolvers may cache the record for up to one hour. Lowering TTL before planned DNS changes reduces propagation delay.
TTL Checker →A Domain Validation certificate is the most basic type of SSL/TLS certificate. The CA only verifies that the applicant controls the domain (via email, DNS record, or file-based challenge). DV certificates are issued quickly (minutes to hours) and are sufficient for most websites. Let's Encrypt issues DV certificates free of charge.
SSL Checker →Email deliverability refers to the ability of an email to reach the recipient's inbox rather than being filtered to spam or rejected. Key factors include: SPF/DKIM/DMARC authentication, sender reputation (IP and domain), content quality, list hygiene, and absence from blacklists.
Mail Deliverability Checker →An Extended Validation certificate requires the most rigorous CA verification process, including legal identity checks on the organisation. EV certificates historically displayed a green bar with the organisation name in browsers, though most modern browsers have removed this visual indicator.
SSL Checker →Forward-Confirmed Reverse DNS verifies that a server's hostname resolves back to the same IP (A record matches PTR record). Receiving mail servers commonly check FCrDNS for the sending IP. A mismatch or missing PTR record increases the probability of email being flagged as spam.
Reverse DNS Lookup →Perfect Forward Secrecy (PFS) is a TLS property where each connection uses a unique ephemeral session key. If the server's private key is later compromised, previously recorded encrypted traffic cannot be decrypted because the session keys were temporary and no longer exist. PFS is provided by ECDHE and DHE key exchange algorithms.
SSL Checker →A glue record is an A record stored at the parent TLD zone that provides the IP address of a nameserver whose hostname is within the same domain it serves. Without glue, a chicken-and-egg problem arises: to find ns1.example.com, you need example.com's nameserver — which is ns1.example.com itself.
NS Lookup →HSTS is an HTTP response header that instructs browsers to only connect to a site over HTTPS — never HTTP — for a specified duration (max-age). Once received, the browser automatically upgrades all HTTP requests to HTTPS before sending them, preventing SSL stripping attacks.
HSTS Checker →HTTP (HyperText Transfer Protocol) is the foundation protocol for data transfer on the web, operating in plaintext. HTTPS is HTTP over TLS — an encrypted, authenticated connection. HTTPS protects data in transit from interception and modification. Google uses HTTPS as a ranking signal.
HTTP Header Checker →The HttpOnly cookie attribute prevents client-side JavaScript from accessing a cookie via document.cookie. This protects session tokens and authentication cookies from being stolen by XSS attacks — even if a malicious script runs on the page, it cannot read HttpOnly cookies.
Cookie Security Checker →An IP (Internet Protocol) address is a numerical label assigned to each device on a network. IPv4 addresses are 32-bit numbers written as four decimal octets (e.g. 93.184.216.34). IPv6 addresses are 128-bit values in hexadecimal notation (e.g. 2606:2800:220:1:248:1893:25c8:1946). DNS A records map domain names to IPv4 addresses; AAAA records map to IPv6.
Website to IP →A Man-in-the-Middle attack occurs when an attacker secretly intercepts and potentially alters communication between two parties. In the context of web security, HTTPS with HSTS, DNSSEC, and certificate pinning are key defences. SSL stripping is a common MITM technique that downgrades HTTPS to HTTP.
Mixed content occurs when an HTTPS page loads resources (scripts, stylesheets, images) over HTTP. Active mixed content (scripts, stylesheets) is blocked by modern browsers. Passive mixed content (images, audio) may be blocked or warned about. Mixed content undermines HTTPS security and triggers browser warnings.
Mixed Content Checker →MTA-STS (Mail Transfer Agent Strict Transport Security) allows domain owners to declare that their mail servers support TLS and that sending mail servers must refuse delivery if a valid TLS connection cannot be established. It prevents STARTTLS downgrade attacks. Requires a DNS TXT record and a policy file at https://mta-sts.domain/.well-known/mta-sts.txt.
MTA-STS Checker →An MX (Mail Exchanger) record specifies the mail servers responsible for accepting email for a domain. Each MX record has a priority value — lower numbers have higher priority. When sending email, the sending server queries MX records and attempts delivery to the highest-priority server first.
MX Lookup →NS records identify the authoritative nameservers for a domain. When a recursive resolver needs to look up a domain, it queries the parent TLD for the domain's NS records, then queries those nameservers for the specific record. A domain should have at least two NS records for redundancy.
NS Lookup →NXDOMAIN (Non-Existent Domain) is a DNS response code indicating that the queried domain does not exist in the DNS. It differs from an empty answer — an empty answer means the domain exists but has no records of the requested type, while NXDOMAIN means the domain itself does not exist.
DNS Lookup →OCSP is a protocol used by browsers to check whether an SSL/TLS certificate has been revoked before establishing a connection. OCSP Stapling is an optimisation where the server periodically fetches a signed OCSP response and includes it in the TLS handshake, eliminating a separate client request to the CA.
SSL Checker →An Organization Validation certificate requires the CA to verify the legal existence of the organisation applying for the certificate, in addition to domain ownership. OV certificates include the organisation's name in the certificate details, providing higher assurance than DV certificates.
SSL Checker →Permissions-Policy (formerly Feature-Policy) is an HTTP header that allows a site to control which browser features and APIs can be used in the page and in embedded iframes — such as camera, microphone, geolocation, and payment. Restricting unused features reduces the attack surface.
Security Headers Checker →A PTR record is a DNS record that maps an IP address back to a hostname — the reverse of an A record. PTR records are stored in the in-addr.arpa zone (IPv4) or ip6.arpa zone (IPv6). They are commonly used by mail servers to verify the hostname of a sending mail server (reverse DNS lookup).
Reverse DNS Lookup →A recursive resolver (also called a recursive nameserver or DNS recursor) is a DNS server that performs the full resolution process on behalf of a client. It queries root nameservers, TLD nameservers, and authoritative nameservers in sequence, caches results according to TTL, and returns the final answer to the client.
HTTP redirects forward clients from one URL to another. A 301 (Moved Permanently) redirect transfers SEO link equity to the new URL and is used for permanent moves. A 302 (Found) redirect is temporary — search engines continue indexing the original URL. Redirect chains (multiple hops) slow page load and dilute link equity.
Redirect Checker →The Referrer-Policy HTTP header controls how much referrer information is sent with requests from your site. The recommended value strict-origin-when-cross-origin sends the full URL for same-origin requests and only the origin for cross-origin requests, balancing analytics needs with user privacy.
Security Headers Checker →SameSite controls whether cookies are sent with cross-site requests. SameSite=Strict only sends cookies with same-site requests. SameSite=Lax (modern browser default) sends cookies on same-site requests and top-level navigations. SameSite=None allows all requests but requires the Secure flag. SameSite protects against CSRF attacks.
Cookie Security Checker →SMTP is the protocol used to send email between mail servers and from email clients to servers. It operates on port 25 (server-to-server), port 587 (client submission with STARTTLS), and port 465 (implicit TLS). SMTP handles the transmission of email; IMAP and POP3 handle retrieval.
SMTP Test →SNI is a TLS extension that allows a client to specify the hostname it is connecting to during the TLS handshake, before the connection is encrypted. This enables a single server to host multiple SSL/TLS certificates on one IP address (virtual hosting over HTTPS), as the server can select the correct certificate based on the SNI value.
SSL Checker →Every DNS zone has exactly one SOA record containing administrative information: the primary nameserver, administrator email, a serial number (zone version), and timing parameters for zone transfers (refresh, retry, expire). The serial number must be incremented each time zone records are updated.
SOA Lookup →SPF is an email authentication standard published as a DNS TXT record that lists which mail servers and IP addresses are authorised to send email for a domain. Receiving mail servers check SPF to verify the sender is authorised. SPF is limited to 10 DNS lookups; exceeding this causes a PermError.
SPF Checker →SPF flattening is the process of replacing include: mechanisms in an SPF record with the actual IP addresses they resolve to, reducing the number of DNS lookups required. This is necessary when an SPF record would otherwise exceed the RFC 7208 limit of 10 DNS lookups, which causes a PermError.
SPF Flattening Tool →An SSL/TLS certificate is a digital certificate that authenticates a website's identity and enables an encrypted HTTPS connection. Modern certificates use TLS (Transport Layer Security); the term "SSL" persists historically. Certificates are issued by Certificate Authorities and contain the domain name, public key, issuer, and validity period.
SSL Checker →STARTTLS is a command used in SMTP (and other protocols) to upgrade an existing plaintext connection to an encrypted TLS connection. Unlike implicit TLS (which starts encrypted from the first byte), STARTTLS begins as plaintext and is upgraded. Without MTA-STS or DANE enforcement, STARTTLS is opportunistic and vulnerable to downgrade attacks.
SMTP Test →TLS is the cryptographic protocol that provides secure communication over a network. It is the successor to SSL and is what HTTPS uses. TLS 1.2 and TLS 1.3 are the current secure versions; TLS 1.0 and 1.1 are deprecated. TLS 1.3 simplifies the handshake and mandates forward secrecy.
SSL Checker →TLS-RPT (TLS Reporting, RFC 8460) enables domain owners to receive daily reports about TLS connection failures experienced by sending mail servers. Reports are sent to an email or HTTPS endpoint specified in a DNS TXT record at _smtp._tls.domain. TLS-RPT is commonly deployed alongside MTA-STS or DANE.
TLS-RPT Checker →A TXT (Text) record is a DNS record that holds arbitrary text data. Originally designed for human-readable notes, TXT records are now used for machine-readable data: SPF email authentication (v=spf1...), DMARC policy (_dmarc.domain), DKIM public keys (selector._domainkey.domain), and domain ownership verification tokens.
TXT Lookup →DNS TTL is the value in seconds attached to a DNS record that tells resolvers how long to cache the record before re-querying the authoritative nameserver. A TTL of 3600 = 1 hour cache. Before planned DNS changes, lower the TTL to 300 seconds to minimise propagation time; restore it afterward.
TTL Checker →A Verified Mark Certificate is a digital certificate issued by a Mark Verifying Authority (e.g. DigiCert, Entrust) that cryptographically proves an organisation owns the trademark for its BIMI logo. Gmail requires a VMC to display BIMI logos; other email clients may display logos without one.
BIMI Checker →WHOIS is a protocol for querying domain registration data: registrar, registrant contact, nameservers, and expiry date. RDAP (Registration Data Access Protocol) is the modern successor with structured JSON responses and better privacy controls. Many registrars now redact personal data to comply with GDPR.
The X-Content-Type-Options: nosniff HTTP header prevents browsers from MIME-sniffing a response away from its declared Content-Type. Without it, a browser might execute a JavaScript file served as text/plain. Setting nosniff ensures resources are only interpreted as their declared type.
Security Headers Checker →X-Frame-Options is an HTTP header that prevents a page from being embedded in an iframe on another domain, protecting against clickjacking attacks. Values: DENY (never allow framing) or SAMEORIGIN (only same-origin frames). It is largely superseded by the frame-ancestors Content Security Policy directive.
Security Headers Checker →XSS is a web security vulnerability where an attacker injects malicious scripts into pages viewed by other users. Stored XSS persists in the database; reflected XSS is in the URL. Defences include output encoding, Content Security Policy (which blocks unauthorised script execution), and HttpOnly cookies to protect session tokens.
CSP Analyzer →A DNS zone file is a plain text file in BIND format (RFC 1035) that contains all DNS records for a domain: SOA, NS, A, AAAA, MX, TXT, CNAME, and others. Zone files are used by authoritative DNS servers and are the standard format for transferring DNS configuration between providers.
DNS Zone File Validator →