Why We Built This
Most small and medium businesses have no visibility into the security posture of their own domain. They don't know if their SPF record is too permissive, whether DMARC is enforcing anything, or if their SSL certificate is about to expire. Attackers love this.
Every week we run consulting engagements that start with the same discovery: the domain's email authentication is broken in one way or another. Once we fix it, phishing attempts stop landing in employee inboxes, partners stop getting spoofed emails from "their" contacts, and deliverability goes up.
The tools to check all of this exist — but they're scattered across 10 different sites, most plastered in ads, some gate results behind a signup, and none walk you through what the numbers mean. So we built our own, consolidated them into one place, and made them free for everyone.
→ Try them now: lbclouds.com/tools
All 7 tools live. Instant results. No signup. No ads.
What's in the Toolkit
1. WHOIS Lookup — Who owns a domain, when does it expire
The WHOIS tool queries the modern RDAP protocol (the successor to classic WHOIS) and returns registrar, registration and expiration dates, nameservers, DNSSEC status, and any non-redacted contacts. Most registrant info is redacted under GDPR — our tool clearly explains what's missing and why.
Use it to: check when a domain you care about expires, identify the registrar to contact for abuse issues, see DNSSEC posture, or discover WHOIS-visible email addresses for your own domain.
2. SPF Checker — Parse and validate your SPF record
Sender Policy Framework (SPF) controls which servers are allowed to send email from your domain. A bad SPF record causes legitimate email to land in spam — or lets attackers successfully impersonate your domain. RFC 7208 caps SPF chains at 10 DNS lookups; exceeding that breaks enforcement entirely.
Our SPF tool does full recursive include expansion and counts every DNS lookup in the chain. It flags common problems: multiple SPF records (invalid per spec), +all (dangerous — allows anyone), missing all mechanism, and lookup-limit breaches before they start bouncing real mail.
3. DKIM Checker — Selector lookup with auto-probe
DomainKeys Identified Mail (DKIM) lets receivers cryptographically verify an email actually came from your domain. Each sending service publishes a public key at selector._domainkey.yourdomain.com. The catch: there's no way to enumerate selectors via DNS — you have to know which one is in use.
The DKIM tool solves this two ways: enter your domain plus a selector, or tick "auto-probe" and we'll test 25 common selectors used by Google Workspace, Microsoft 365, SendGrid, Mailgun, Mailchimp, Zoho, ProtonMail and more. Key strength is analyzed and flagged if below 2048-bit.
4. DMARC Checker — Policy, alignment, reporting
DMARC ties SPF and DKIM together and tells receivers what to do when checks fail: nothing, quarantine, or reject. It also gives you aggregate reports showing spoofing attempts against your domain. Without DMARC at p=quarantine or p=reject, SPF and DKIM alone don't stop determined attackers.
Our DMARC tool parses every tag, explains what each one means, and flags common misconfigurations — no policy at all, p=none (monitor only, not enforcing), missing rua reporting address, partial pct, and invalid alignment modes.
Want more than a snapshot? A record check tells you what your DNS says today; it can't tell you who is actually sending as your domain. For continuous monitoring — every sender classified, instant spoofing alerts, and a guided path to p=reject — see DMARCDECK, our hosted DMARC monitoring service (30 days free), or read our guide to stopping email spoofing.
5. MX Records — Mail server routing & provider detection
MX records tell the internet which servers handle email for your domain. The MX tool lists all MX hosts with priorities, resolves each to IPv4 and IPv6 addresses, and automatically detects your email provider — Google Workspace, Microsoft 365, Zoho, ProtonMail, Fastmail, SES, Mimecast, Mailgun, SendGrid, Yandex, Rackspace and several more.
Useful for: sanity-checking that your email is actually routing where you expect, identifying competitors' or partners' mail platforms, catching MX entries that resolve to no IP (silent mail delivery failure).
6. SSL / TLS Certificate Inspector
The SSL tool connects to your domain on port 443, pulls the certificate chain, and reports issuer, subject, SANs, expiry countdown, cipher, TLS version, and signature algorithm. It flags: expired or expiring-soon certs, self-signed chains, hostname mismatches, weak SHA-1/MD5 signatures, and legacy TLS 1.0/1.1.
Run it after any deployment, before letting a cert hit its renewal window, or when you're debugging "your connection is not private" warnings.
7. HTTP Security Headers — Graded A+ to F
Modern browsers enforce a web of security headers: HSTS forces HTTPS, CSP blocks unauthorized scripts, X-Frame-Options prevents clickjacking, Referrer-Policy limits data leakage, Permissions-Policy gates sensitive browser APIs. Most sites publish none of them.
Our Security Headers tool fetches any URL, inspects the response headers, and returns a weighted A+ through F grade with per-header pass/weak/missing verdicts and specific fix recommendations. HSTS and CSP carry the most weight; X-Content-Type-Options, X-Frame, Referrer-Policy, and Permissions-Policy next; COOP/COEP as bonus.
New in October 2026: PHP2Shell Vulnerability Checker
Not an email tool, but the same idea. The PHP2Shell checker reads the PHP version a website advertises and tells you whether it is below the fixed releases for CVE-2026-109618 and CVE-2026-109619, the two critical remote-code-execution bugs patched on 21 October 2026. One passive page request, no exploit traffic, and you can paste a php -v version to have it judged in your browser. Background and server commands in our PHP2Shell guide.
Plus: Full Email Deliverability Audit (Email-Verified)
The individual tools are great for one-off checks. For a consolidated view, we built a Full Email Deliverability Audit that runs SPF + DKIM + DMARC + MX + SSL in parallel, scores each component out of 100, and returns an overall A+ through F grade with prioritized recommendations.
The audit requires email verification — either to a role address at the audited domain (admin@, postmaster@, webmaster@, hostmaster@) for domain-ownership verification, or to any email you control. The full report is also emailed to you for reference, and the verification exists to prevent the tool being abused as a bulk reconnaissance scanner against third-party domains.
Why "free" isn't a marketing stunt
Visibility into your own infrastructure should never cost $500 per month. Commercial WHOIS APIs, email security audit platforms, and monitoring dashboards are priced for enterprises. Small and medium businesses in Lebanon, the Middle East and frankly anywhere — they need the same tools, just without the enterprise budget.
We host these on Netlify, hit a handful of free public APIs (RDAP, DNS, Cloudflare Turnstile), and the marginal cost of each check is measured in microseconds. Making them free costs us essentially nothing; keeping them paywalled would waste the time of thousands of IT admins.
What's Next
Monitoring & alerts are on the roadmap: tell us which domains you run, and we'll ping you if SPF, DMARC, DKIM or SSL change unexpectedly. For now, the 7 tools plus the full audit are live today and will stay live as long as LBClouds exists.
If something is broken, unclear, or missing from the toolkit, get in touch. And if you need deeper analysis — hardening your email stack end-to-end, managed security monitoring, incident response — we still do consulting. The tools just help you see the problem first.