Free online developer tools
Free online network tools to look up IP addresses, Whois records, DNS records, HTTP headers, SSL certificates, and user agents. These tools query public network data sources to return live results, so they require a network request.
A DNS lookup returns records of a specific type, and knowing which is which saves a lot of guessing:
TTL is a caching limit, not a schedule. A record's TTL tells resolvers the maximum number of seconds they may serve it from cache before asking again — a TTL of 3600 means an answer can be reused for up to an hour.
That makes "DNS propagation" a misleading phrase. Nothing spreads outward from your server: the authoritative record changes instantly. What you actually wait on is caches around the world expiring the old answer according to the TTL they were previously handed. The practical move before a planned change is to lower the TTL a day ahead, so caches let go of the old value quickly when you cut over.
WHOIS is the old domain-registration lookup: plain text with no standard format, which every client has to parse loosely. RDAP (Registration Data Access Protocol) is its modern replacement — it returns structured JSON, supports standardized queries, and is what ICANN now requires registries to run. Either way, since GDPR took effect in 2018, the registrant's personal contact details are commonly redacted for many domains, showing as "REDACTED FOR PRIVACY" or a registrar privacy proxy rather than a real name and email.
A certificate is not trusted on its own. The leaf certificate for your domain is signed by an intermediate CA, which chains up to a root CA in the client's trust store. Your server must send the leaf and the intermediates; omitting an intermediate produces the classic "works in my browser, fails elsewhere" bug, because some clients happen to have cached the intermediate while others have not. Two failures people conflate are genuinely different: an expired certificate is past its validity dates, while a hostname mismatch means the certificate's Subject Alternative Name list does not cover the domain you requested — different causes, different fixes.
Strict-Transport-Security (HSTS) tells browsers to use HTTPS for all future visits,
closing the initial-redirect window. Content-Security-Policy (CSP) restricts which
scripts, styles, and other resources may load and is the main structural defense against XSS.
X-Content-Type-Options: nosniff stops the browser from second-guessing a response's
declared type and treating, say, an uploaded file as executable script.
A User-Agent string is a pile of legacy compatibility tokens rather than a clean identifier.
Every mainstream browser still begins with Mozilla/5.0 — a 1990s holdover from when
servers gated features on Netscape. Chrome's string additionally carries
AppleWebKit, KHTML, like Gecko, and Safari to satisfy the
same kind of old content-negotiation checks. That accumulated cruft is why parsing UA strings is
unreliable and why browsers are shifting toward User-Agent Client Hints.
There is no propagation — authoritative records update immediately. What you wait on is caches expiring the old answer according to its TTL, so a record with a one-hour TTL can be served stale for up to an hour. Lowering the TTL before a planned change shortens that window.
Both return domain registration data, but WHOIS is unstructured plain text with no standard format, while RDAP is its modern replacement that returns structured JSON and supports standardized queries. ICANN now requires registries to offer RDAP.
Since GDPR took effect in 2018, registrars redact registrant personal data for many domains, replacing the name, email, and phone with "REDACTED FOR PRIVACY" or a privacy-proxy contact. The domain's technical records (nameservers, dates) usually remain visible.
Most often the server is not sending the intermediate certificate. Clients that have cached the intermediate still build a valid chain, while clients that have not will fail. Configure the server to send the full chain — leaf plus intermediates — but not the root.
An expired certificate is outside its valid-from/valid-to dates and is fixed by renewing it. A name mismatch means the certificate is valid but its Subject Alternative Names do not include the hostname you requested, which is fixed by issuing a certificate that covers that name.