Do you store the domains and results I check?

Server tools process requests in memory and persist neither domain nor result. Expensive queries are only briefly cached for technical reasons (e.g. mail server check and Certificate Transparency counts one hour each), not tied to a person. Browser helpers like the JWT decoder or encoder never leave your machine at all.

What is the difference between server checks and browser helpers?

Server checks query an external host or service live from our EU servers (DNS, SSL, mail, security …) and are subject to a fair-use limit. Browser helpers compute purely locally in your browser, send nothing and have no rate limit — suitable even for sensitive input such as API keys or tokens.

Is there a limit on how often I may call a tool?

Most server tools are throttled to 30 requests per minute per IP. The bulk IP lookup has a stricter limit of 10 per minute because one request triggers up to 50 geo lookups. The speed test is deliberately exempt so the throughput measurement is not distorted.

Can I scan third-party servers with the tools?

The tools are meant for diagnostic use, not bulk scraping or attacks. We deliberately do not offer port scanners or active mail relay testers because both are legally sensitive or can harm third parties. URL-fetching tools block private and local address ranges.

Are these checks the same as in the dashboard monitoring?

Partly. Some checks — DNSSEC, Open Graph, IP blacklist, cookie scanner and subdomain inventory — run automatically and recurrently per website in the dashboard. The public tools instead give you a snapshot on demand. When you start a scan in the dashboard, DNSSEC, Open Graph, IP blacklist and cookie scanner run along with it.

Free network & DevOps tools

59 free tools for DevOps, SRE and web admins — no signup, EU-hosted, GDPR-compliant. Server checks (DNS, SSL, mail, security, GDPR, accessibility, SEO, performance, AI readiness) and browser helpers (all data stays in your browser), including 10 geo tools. On /tools all tools are grouped into 7 categories.

# Server checks (35)

These tools query external hosts or services live. Fair-use limits, no signup.

What is my IP?

Your IP, geo, ASN, reverse DNS, user agent

/tools/meine-ip

DNS lookup (multi-resolver)

A/AAAA/MX/NS/TXT/CAA at Google, Cloudflare, AdGuard in parallel via DoH

/tools/dns-lookup

DNSSEC validator

DNSKEY/DS/AD bit, KSK/ZSK + algorithm

/tools/dnssec

DNS propagation multi-region

6 global JSON-DoH resolvers in parallel

/tools/dns-propagation

HTTP header inspector

All response headers incl. redirect hops, 9 security headers graded

/tools/http-header

Security header score (A–F)

Weighted grade over 10 pillar headers with Mozilla-Observatory CSP detail analysis

/tools/security-score

SSL/TLS inspector

Cert, chain, SAN, OCSP stapling, HSTS preload status, TLS cipher probe (1.0/1.1/1.2/1.3), Certificate Transparency logs

/tools/ssl-check

Mail server check

MX + reverse DNS, SPF, DMARC with all tags (sp/aspf/adkim/rua/ruf/fo), 61 DKIM selectors in parallel, MTA-STS + policy file, TLS-RPT, BIMI with VMC cert, domain DNSSEC

/tools/mail-check

IP blacklist check

16 public DNSBLs (Spamhaus, Barracuda, CBL/Abuseat …)

/tools/ip-blacklist

Whois/RDAP lookup

Registrar, status flags, nameservers via RDAP

/tools/whois

ASN lookup

IP to provider, AS number, country, IP range via Team Cymru

/tools/asn-lookup

Reverse IP lookup

PTR + geo + co-hosted domains (which other sites run on the IP)

/tools/reverse-ip

Speed test

Measure download, upload, latency and jitter to EU servers

/tools/speed-test

Ping test

30 pings with min/avg/max/jitter/loss visualization

/tools/ping-test

Pagespeed test with web vitals

Server RTT (TCP/TLS/TTFB/total) over 3 runs + real web vitals (LCP/CLS/FCP/TBT, median over 3 headless Chromium runs)

/tools/pagespeed

robots.txt + sitemap validator

Syntax check + recursive sitemap-index walk + URL sample HEAD validation

/tools/robots-sitemap

Open Graph & social preview

How FB/X/LinkedIn/WhatsApp render your link

/tools/open-graph

Subdomain finder (passive)

Certificate transparency logs (crt.sh, certspotter) and the HackerTarget host search, queried one after another

/tools/subdomains

GDPR cookie scanner

Pre-consent cookies + third-party domains via headless Chromium (catches JS-injected trackers)

/tools/cookie-scan

Resource waterfall

Full page audit via headless Chromium: all resources including JS-injected fetch/XHR, defer/async, connection reuse

/tools/resource-waterfall

DMARC/DKIM/SPF validator

SPF, DMARC policy + tags, DKIM selectors via DNS lookup

/tools/dmarc-validator

Broken link checker

Check all links on a page in parallel, max 50 per call

/tools/broken-links

Redirect checker

Full redirect chain with status + location header per hop

/tools/redirect-checker

Core Web Vitals (CrUX)

LCP/CLS/INP from real Chrome user data (75th percentile)

/tools/core-web-vitals

Tech stack detector

CMS, frameworks, server software via headers + HTML patterns

/tools/tech-stack

BFSG accessibility check

Automated WCAG 2.2 test via axe-core in headless browser

/tools/bfsg-check

Check GDPR mandatory sections via keyword heuristics

/tools/datenschutz-crawler

Google Fonts check

Detect external Google Fonts loading (GDPR risk)

/tools/google-fonts-check

Consent checker

Detect pre-consent trackers in initial HTML

/tools/consent-checker

BIMI validator

Check BIMI DNS record + logo URL + DMARC prerequisite

/tools/bimi-validator

MTA-STS checker

Validate DNS record, policy file (.well-known) and TLS-RPT

/tools/mta-sts-checker

Sitemap validator (XML)

Load XML sitemap, validate format, count URLs

/tools/sitemap-validator

Online cURL tool

Send HTTP request with any method, headers and body

/tools/curl-tester

AI readiness check

AI-crawler permission (robots.txt), llms.txt, structured data and sitemap → AI readiness score; SSRF-safe, nothing stored

/tools/ki-ready

IP address check

Full IP profile: location with accuracy radius, ASN/provider/RIR, time zone, currency plus VPN, Tor and risk signals

/tools/ip-check

IP reputation & abuse score

Abuse score 0–100, risk level plus VPN, Tor, hosting and bogon signals with ASN/RIR context

/tools/ip-reputation

VPN & proxy detection

Signals for VPN, Tor exit, iCloud relay, satellite and hosting IPs — plus abuse score, risk, ASN and country

/tools/vpn-proxy-check

Data center or residential?

Distinguishes hosting/data-center networks from residential lines — incl. cloud provider, connection type and ASN

/tools/rechenzentrum-check

Time zone & country by IP

Time zone with offset and local time, DST status, calling code, currency, official languages, continent and EU membership

/tools/ip-zeitzone

Bogon & anycast check

Checks whether an IP is from a reserved bogon range and whether it is operated via anycast — with ASN and RIR context

/tools/bogon-anycast

ASN & network lookup

Resolve an IP, CIDR block or AS number to organization, provider domain, network prefix, RIR plus hosting and abuse signals

/tools/asn-netz-lookup

Reverse DNS / PTR lookup

PTR hostnames of an IP plus ASN, provider and country — for FCrDNS checks and classifying server logs

/tools/reverse-dns

Bulk IP geolocation

Up to 50 IP addresses or log lines at once — country, city, ASN/ISP, VPN/hosting and abuse signals, in-browser CSV export

/tools/massen-ip

Email header analysis

Analyze raw email headers: presumed origin IP with geo and risk estimate, received hops plus SPF/DKIM/DMARC

/tools/email-header

# Browser helpers (14)

These tools compute purely locally in your browser. No data transfer, no rate limit, suitable for sensitive input (API keys, tokens).

Imprint checker (§ 5 DDG)

Mandatory fields per § 5 DDG via keyword heuristics (browser-only)

/tools/impressum-checker

JWT decoder

Header/payload/signature, exp status, HS256+RS256 verify

/tools/jwt-decoder

JSON formatter & validator

Pretty-print, minify, key-sort, errors with line+column

/tools/json-formatter

JSONL validator

Validate JSON Lines line by line, statistics, export cleaned file

/tools/jsonl-validator

Encoder & hash

Base64, URL, MD5, SHA-1/256/512, HMAC

/tools/encoder

UUID & ULID generator

UUID v4/v7 + ULID, bulk + validator

/tools/uuid-generator

Subnet calculator (CIDR)

Full IPv4 + IPv6, range/broadcast/mask

/tools/subnet-calc

Email header analyzer

Received hops, SPF/DKIM/DMARC, phishing hints

/tools/mail-header

Password generator

Cryptographically secure (Web Crypto API), bulk + entropy score

/tools/password-generator

A/B test sample-size calculator

Two-proportion z-test: sample size + days-to-significance from baseline, MDE, α, power

/tools/sample-size

Regex tester

Live highlighting, capture groups, named groups, all JS flags

/tools/regex-tester

Base64 image converter

Image to data URI via drag & drop (PNG/JPG/GIF/SVG/WebP)

/tools/base64-image

Cron parser

Analyse cron expressions, compute next 10 executions

/tools/cron-parser

HTTP status code reference

Searchable reference of all HTTP status codes (1xx–5xx)

/tools/http-status

robots.txt + llms.txt generator

Allow/block AI crawlers + sitemap reference → robots.txt and llms.txt, in-browser

/tools/robots-llms-generator

# Privacy & responsible use

No logging: Server tools process requests in memory, persist neither domain nor result. Browser tools (JWT, JSON, encoder, UUID, subnet, mail header) never leave your machine.
Fixed categories, not usage tracking: The tool overview /tools is grouped into fixed categories — we keep no per-tool usage counters and sort nothing by popularity. No personal tracking, no storage of your IP address.
Fair use: Tools are meant for diagnostic use, not bulk scraping. For thousands of queries per hour use our authenticated API with a paid plan.
EU-Hosting: All tools run on our servers in EU data centers (Falkenstein, Nuremberg) — GDPR-compliant, no third-country transfer.
Deliberately omitted: Port scanners and mail relay testers are not included — both are legally sensitive or can harm third parties.

On the public tool overview /tools all 59 tools (including the 10 geo tools) are grouped into 7 categories so you find the right tool faster.

# How deep the server checks go

The one-liner on the card only shows the tip. Three examples of what is actually queried under the hood.

SSL/TLS inspector — far more than the expiry date

A single call opens a TLS socket, reads the certificate and full issuer chain and adds active probes: key type and length (RSA/ECDSA incl. curve), all SAN entries with hostname match, OCSP stapling, the HSTS header plus preload-list status via the official hstspreload.org API, a cipher probe against TLS 1.0/1.1/1.2/1.3, the number of Certificate Transparency log entries via crt.sh, the HTTP-to-HTTPS redirect and a mixed-content scan of the start page (active and passive separated).

Security header score — 10 weighted pillar headers

Ten headers are graded: Strict-Transport-Security (weight 20), Content-Security-Policy (25), X-Frame-Options (10), X-Content-Type-Options (10), Referrer-Policy (8), Permissions-Policy (8), Cross-Origin-Opener-Policy (7), Cross-Origin-Embedder-Policy (5), Cross-Origin-Resource-Policy (4) and a Server/X-Powered-By version leak (3). Each header is scored on a sliding scale — a CSP with unsafe-inline counts less than a strict one. The weighted sum yields a percentage and from it a school grade from A to F. The CSP is additionally analysed directive by directive (modelled on Mozilla Observatory), even when only set in report-only mode.

Mail server check — one domain, one click, full deliverability

Checked in parallel via DNS-over-HTTPS: MX records including reverse DNS of the first mail servers, SPF, DMARC with all tags (policy p, subdomain policy sp, pct, aspf, adkim, rua, ruf, fo), 61 common DKIM selectors at once, MTA-STS plus the fetched policy file under .well-known, TLS-RPT, BIMI including logo and VMC certificate URL, plus the DNSSEC status of the domain. From these signals a grade is derived (e.g. dmarc_strict, mta_sts_enforce). The result is cached for one hour.

# Limits, SSRF protection and caching

The server checks are public, but not unprotected. What applies technically:

Rate limit: Most server tools run at 30 requests per minute per IP. The bulk IP lookup is throttled to 10 requests per minute because a single request triggers up to 50 geo lookups. The speed test is deliberately exempt — a real throughput test needs many requests in a short window.
SSRF-Schutz: Tools that fetch a foreign URL (headers, security score, SSL, cookie scan, sitemap …) go through a hardened HTTP client that blocks private and local address ranges and re-validates every redirect hop including the connected IP. Inputs are checked against a hostname filter up front.
Caching: Expensive queries are briefly cached — mail server check and Certificate Transparency counts for one hour, the subdomain aggregator likewise. That keeps the tool usable even when an external source (e.g. crt.sh) is slow to respond.
Multiple sources, not one: Comparison tools query several providers — DNS lookup at Google, Cloudflare and AdGuard and DNS propagation against 6 global DoH resolvers in parallel, the subdomain finder one after another at crt.sh, certspotter and HackerTarget. If one source fails, the result stays usable.

# Extended monitoring in the dashboard

These checks run automatically per website and are visible in the "Extended monitoring" card on the website detail page.

Check	Frequency	What is checked
DNSSEC-Status	every 6h	DNSKEY, DS in parent zone, AD bit (validated/unsigned/no-ds)
Open-Graph	daily	og:title, og:description, og:image, twitter:card, canonical
IP-Blacklist	daily	MX IPs of the domain against 11 DNSBLs (Spamhaus, Barracuda, CBL/Abuseat …)
Cookie-Scanner	daily	Third-party domains and pre-consent cookies
Subdomain-Inventur	on click	Known subdomains from certificate transparency logs (crt.sh)

When you start a scan yourself via Scan → URL, DNSSEC, Open Graph, IP blacklist and cookie scanner run as part of the scan — values are immediately up to date without waiting for the next daily check.

# API endpoints

Public endpoints live under api.xictraq.com/api/tools/* and return JSON. Not officially documented as an API — schemas may change.

GET https://api.xictraq.com/api/tools/security-score?url=example.com

{
  "grade": "B",
  "percent": 78,
  "checks": [
    { "key": "hsts", "name": "Strict-Transport-Security", "present": true, "score": 1, "weight": 20 },
    { "key": "csp",  "name": "Content-Security-Policy",   "present": true, "weight": 25 }
  ],
  "waf": null,
  "checked_at": "2026-06-20T09:14:07+00:00"
}

For stable API usage with authentication, history and SLA, we recommend the XICTRAQ plan. The server checks of these tools are integrated as monitoring functions there.

Frequently asked questions about the tools

No. All 59 tools work without signup. For continuous monitoring with history, alerting and authentication there are the paid XICTRAQ plans — the tools themselves stay free.