drwho.me network and developer tools

1. Tool surface changed

   2026-09-17 20:25 UTC · 23 d ago

   Added "base64_decode", "base64_encode", "dossier_summary" and 5 more; removed "dossier_full"; changed the definition of "dns_lookup", "dossier_ai_crawlers", "dossier_cors" and 18 more (22 tools before, 29 now)

   dns_lookupchanged

   title

   before
   —

   after
   DNS lookup

   description

   Context lookup: Resolve a singleone DNS record type (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, or SRV) for a name and return the raw answers. Use for a quick, targeted lookupslookup, ofincluding oneon recordsubdomains type;and names such as _dmarc.example.com; prefer dossier_dns for a full multi-typedomain's DNSmain auditrecords in parallel, or dossier_full for a complete domain healthone check.call. Queries Cloudflare DoH (1.1.1.1/dns-query) over HTTPS, follows CNAME chains, 5 s timeout.DNS-over-HTTPS. Returns a JSON array of answer objects with {name, type, andTTL, data}; fields.an Onempty error,array returnsmeans athe stringname describingexists thebut DNShas failure.no record of that type.

   94 words differ · removed · added

   inputSchema

   {"$schema":"http://json-schema.org/draft-07/schema#","additionalProperties":false,"properties":{"name":{"description":"Domain name or hostnameName to resolve, e.g. example.com or mail.example.com. FQDN preferred; relative labels are accepted.","type":"string"},"type":{"description":"DNS recordRecord type to query. Common choices: A (IPv4), AAAA (IPv6), MX (mail), TXT (SPF/DKIM/verification), NS (nameservers), CNAME (alias).","enum":["A","AAAA","MX","TXT","NS","CNAME","SOA","CAA","SRV"],"type":"string"}},"required" ⟨4 unchanged words⟩ 

   65 words differ · removed · added

   annotations

   before
   —

   after
   {"openWorldHint":true,"readOnlyHint":true}

   dossier_ai_crawlerschanged

   title

   before
   —

   after
   AI-crawler policy

   description

   Core dossier check: Report what a domain's AI-crawler policy — whether robots.txt allows, blocks, or is silentsays onto the six major AI agentscrawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, meta-externalagent).: allowed, blocked or unspecified for each. Use to answer "doeswhether thisa

   dossier_corschanged

   title

   before
   —

   after
   CORS checker

   description

   Core dossier check: Send a CORS preflight (OPTIONS request) to https://<domain>/ and return the access-control-* response headers. Use to verify CORS policy for aheaders specificin origin-methodthe pair,answer. orUse to check whether a domainsite allowsaccepts cross-origin 

   dossier_ct_logchanged

   title

   before
   —

   after
   Certificate log lookup

   description

   CoreList dossiersubdomains check:of Discovera subdomainsdomain visiblethat appear in Certificate Transparency logs. Use forto attack-surfacemap mapping;what 

   dossier_dkimchanged

   title

   before
   —

   after
   DKIM lookup

   description

   Core dossier check: Probe a domain'sdomain for DKIM public keys byat querying<selector>._domainkey.<domain>. <selector>._domainkey.<domain>Pass forselectors eachwhen selector.you Useknow to

   dossier_dmarcchanged

   title

   before
   —

   after
   DMARC checker

   description

   Core dossier check: RetrieveFind and parse a domain'sthe DMARC policy from itsat _dmarc.<domain> TXT record, returning all tags. Use to audit email authentication policy,into verifyits thetags (p, (policy)sp, andpct, rua,

   dossier_dnschanged

   title

   before
   —

   after
   DNS records

   description

   Core dossier check: Fetch a domain's full DNS profile — A, AAAA, NS, SOA, CAA, and TXT records — all in parallel.one call. Use as the first step of a domain audit or when you need a comprehensive DNS snapshot in one call;review; prefer dns_lookup for a single record type, or dossier_full for all 10 dossierMX, checksCNAME at

   dossier_dnssecchanged

   title

   before
   —

   after
   DNSSEC checker

   description

   CoreCheck dossierwhether check:a Verifydomain's DNSSECzone chain-of-trustis forsigned awith domainDNSSEC (and validates: 

   dossier_headerschanged

   title

   before
   —

   after
   Security headers

   description

   Core dossier check: Fetch https://<domain>/ and return all HTTPevery response headersheader, with an audit highlighting missing or misconfigured security headers.so Useyou tocan review CSPStrict-Transport-Security, HSTSContent-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy;

   dossier_llms_txtchanged

   title

   before
   —

   after
   llms.txt checker

   description

   Core dossier check: DetectCheck whether a domain publishes an llms.txt at its, rootthe —markdown theindex emergingsome conventionsites thatprovide givesfor AI agents

   dossier_mta_stschanged

   title

   before
   —

   after
   MTA-STS checker

   description

   Core dossier check: Fetch and validate a domain's MTA-STS policy (mode, mx, max_age, policy id). Use to confirm inbound SMTPmail isto lockedthe todomain TLSmust forbe thisdelivered domain.over TLS. 

   dossier_mxchanged

   title

   before
   —

   after
   MX lookup

   description

   Core dossier check: Look upList a domain's MX (mail exchanger) records and return them sorted ascending by priority. Use when verifying inbound-mail routing or as a precursor to SPF or DMARC checks; prefer dns_lookup with type=MXsee ifwhere youa onlydomain's needinbound themail raw

   dossier_redirectschanged

   title

   before
   —

   after
   Redirect chain

   description

   Core dossier check: Trace the full HTTP redirect chain starting from https://<domain>/, recordingone eachentry hop'sper hop with its status code and destinationtarget, URL.up to 10 hops. Use to debug redirect loops, verify HTTP→HTTPS upgrades, or audit link shorteners; stops at

   dossier_security_txtchanged

   title

   before
   —

   after
   security.txt checker

   description

   Core dossier check:Check Verifywhether a domain publishes a security.txt/.well-known/security.txt (RFC 9116) at /.well-known/security.txt —, the standard machine-readableway channelto fortell reportingresearchers vulnerabilities.where Use

   dossier_spfchanged

   title

   before
   —

   after
   SPF checker

   description

   Core dossier check: RetrieveFind and parse a domain's SPF record, decomposing it into mechanisms andits qualifiers.mechanisms. Use to verifycheck emailwhich senderservers policy,may debugsend delivery

   dossier_tlschanged

   title

   before
   —

   after
   TLS certificate

   description

   Core dossier check: Fetch and inspectRead the TLS certificate presented by a domain presents on port 443: subject, returningissuer, chainvalidity detailsdates, anddays validityremaining, period.subject Usealternative

   dossier_tlsrptchanged

   title

   before
   —

   after
   TLS-RPT checker

   description

   Core dossier check: Look up a domain's TLS-RPT (SMTP TLS Reporting) policy.policy at _smtp._tls.<domain>. Use to confirm the domain receives reports ofabout SMTP-TLSfailed failures.TLS Resolvesdelivery _smtp._tls.<domain>of TXTits

   dossier_web_surfacechanged

   title

   before
   —

   after
   Web surface

   description

   Core dossier check: SnapshotSummarise a domain's public web surface: robots.txt, sitemap.xml, and the home-page <head>home metadatapage's (title, description, OpenGraph, and Twitter cards).card tags. Use for SEO audits,a contentquick discovery,

   dossier_whoischanged

   title

   before
   —

   after
   WHOIS lookup

   description

   Core dossier check: Look up thea domain's registrar, creation date, expiry date, and registry statusesstatuses. forUse afor domain.an Useownership foror ownership/expiryexpiry

   ip_lookupchanged

   title

   before
   —

   after
   IP lookup

   description

   Context lookup:Look Resolveup an IPv4 or IPv6 address: tocity, itsregion, geolocationcountry, ASNcoordinates, orgtimezone name,and the network (ASN and city/country.organisation)

   user_agent_parsechanged

   title

   before
   —

   after
   User agent parser

   description

   Context lookup: Parse a User-Agent header string into structured browser, OSoperating system, device type, and rendering-enginerendering components.engine. Use to identify client capabilities from a raw UA string, e.g. when analysingreading server logs or request headers; does not perform any network lookups — entirely local parsing.headers. Runs synchronously using the ua-parser-js library

   base64_decodeadded

   Base64 decode — Decode base64 to UTF-8 text. Accepts the standard and the URL-safe alphabet, with or without padding or line breaks. Fails when the input is not valid base64 or does not decode to text (binary data is not returned). Runs locally.

   base64_encodeadded

   Base64 encode — Encode UTF-8 text as base64. Set url_safe for the URL-safe alphabet (- and _ in place of + and /, no padding), as used in JSON Web Tokens. Runs locally. Returns the encoded string.

   dossier_summaryadded

   Domain summary (9 checks) — Run the nine DNS, email-authentication and TLS checks on a domain in parallel and return one graded line per check: DNS records, MX, SPF, DMARC, DKIM, DNSSEC, TLS-RPT, MTA-STS and the TLS certificate. Use it first when asked how a domain is set up or whether its email can be spoofed; then call the single dossier_* tool for any check you need the raw data for. Each line has the check id, its status, a severity (info, low, medium, high, critical) and a one-line reason, graded by the same rules as Domain Posture. It does not return raw records or fix instructions, and it leaves out the nine web …

   json_formatadded

   JSON formatter — Validate JSON and re-print it with an indent of 2 or 4 spaces, or minified with indent 0. Use to check whether a string is valid JSON or to make it readable. Runs locally. Returns the formatted JSON, or the parser's error message.

   jwt_decodeadded

   JWT decoder — Decode a JSON Web Token's header and payload. It does NOT verify the signature, so never treat the claims as trusted on the strength of this tool. Use to inspect claims such as exp, iss and aud while debugging. Runs locally; the token is not stored or sent anywhere. Returns JSON {header, payload, signature}.

   url_decodeadded

   URL decode — Decode percent-encoded text. Fails on a malformed sequence such as a lone % sign. A plus sign is left as a plus; replace it with a space first if the text came from an HTML form. Runs locally.

   url_encodeadded

   URL encode — Percent-encode text for use in a URL query value or path segment (encodeURIComponent rules: everything except letters, digits and - _ . ! ~ * ' ( ) is encoded). Runs locally. Returns the encoded string.

   uuid_generateadded

   UUID generator — Generate UUIDs. Version 4 is fully random. Version 7 starts with a millisecond timestamp, so values sort by creation time, which suits database keys. Runs locally with a cryptographic random source. Returns a JSON array of strings.

   dossier_fullremoved

   Aggregate dossier check: Run all 10 Domain Dossier checks — dns, mx, spf, dmarc, dkim, tls, redirects, headers, cors, web-surface — in parallel and return all results in a single response. Use when you need a comprehensive domain health snapshot in one call; counts as ONE paywall call regardless of how many checks run. For a single focused check, prefer the individual dossier_* tools to minimise latency. Fires all 10 checks concurrently via Cloudflare DoH or direct HTTPS, 5 s per-check timeout. Returns a JSON object keyed by check id (dns, mx, etc.), each value a CheckResult discriminated uni…

2. TLS

   2026-09-14 01:24 UTC · 26 d ago

   Certificate recorded, valid to 2026-11-11

3. Authorization

   2026-09-14 01:24 UTC · 26 d ago

   Authorization not required

4. Status

   2026-09-13 05:25 UTC · 27 d ago

   Recently observed → Live

5. Tool surface

   2026-09-13 05:24 UTC · 27 d ago

   First tool surface recorded: 22 tools (server version 0.1.0)

6. Status

   2026-09-12 14:26 UTC · 28 d ago

   Live → Recently observed

Showing the latest 6 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed