Subnet + User Agent
Calculated or parsed on your device without transmitting the input.
Fast, private network diagnostics
Diagnose any
domain or IP in seconds.
Start with one automatic SuperTool report, then open any focused DNS, email, RDAP, SSL or network check—without an account.
Network Tools / CAA Checker
Privacy-first
CAA Record Checker
See which certificate authorities are authorized to issue TLS certificates for a domain.
Encrypted DNS
How this result is produced
An absent CAA record allows any publicly trusted certificate authority to issue after normal validation.CAA records are queried through Cloudflare's public DNS-over-HTTPS resolver.
Built for quick answers
Clean results without dashboards, accounts or unnecessary steps.
Lightweight by design
Local calculation and public standards keep infrastructure costs low.
Privacy-respecting
NexKit does not create a searchable history of your network queries. Cloudflare Web Analytics measures aggregate visits and performance.
Know what you are checking
A complete toolkit for everyday network troubleshooting.
Check connectivity and identity, verify DNS and registration data, review certificates and response headers, then calculate IPv4 network ranges—all from one focused workspace.
Transparent by design
Know where every result comes from.
NexKit combines local browser calculations with public, standards-based network services. No account or NexKit query history is created.
DNS + Reverse DNS
Resolved through an encrypted public DNS-over-HTTPS request.
RDAP + Certificates
Read from authoritative registry routes and public certificate logs.
IP + IPv6 + Headers
Checked through focused public endpoints; providers may apply rate limits.
Common questions
Useful context before you act on a result.
Does NexKit store my network queries?
NexKit does not create an account or searchable query history. Tools that use public endpoints still send the minimum lookup value to the named service that produces the result.
What is the difference between DNS and reverse DNS?
DNS normally maps a hostname to records such as IP addresses. Reverse DNS maps an IP address back to an optional PTR hostname.
Is RDAP the same as WHOIS?
RDAP provides similar registration data through structured HTTPS responses. Available fields and redaction vary by registry.
Does the SSL checker connect to the live server?
It reads the newest matching public Certificate Transparency record. Use it for certificate identity and lifecycle checks, not as proof of the server's current TLS configuration.
Available now
One SuperTool plus forty-three focused tools.
What Is My IP + IP LookupLiveIPv6 TestLiveDNS LookupLiveDNS PropagationLiveDNSSEC CheckerLiveDMARC CheckerLiveSPF CheckerLiveDKIM CheckerLiveMX LookupLiveBIMI CheckerLiveMTA-STS CheckerLiveTLS-RPT CheckerLiveDomain HealthLiveCAA CheckerLiveSOA LookupLiveSRV LookupLiveIPv4 ConverterLiveNS LookupLiveTXT LookupLiveCNAME LookupLiveIPv6 ConverterLiveIP Range to CIDRLiveCIDR to IP RangeLiveSubnet Mask ConverterLiveIP in CIDRLivePunycode ConverterLivePort LookupLiveIPv6 Subnet CalculatorLiveCIDR MergeLiveMAC FormatterLiveURL ParserLiveHTTPS / SVCB LookupLiveUUID GeneratorLiveHash GeneratorLiveBase64 EncoderLiveTimestamp ConverterLiveHTTP Status LookupLiveReverse DNSLiveRDAP / WHOISLiveSSL Certificate CheckerLiveSubnet / CIDR CalculatorLiveHTTP HeadersLiveUser Agent ParserLive