# DNS + Certificate Explorer

> DNS records, e-mail security, CAA, live TLS certificate and CT history for a domain. Resolves A, AAAA, CNAME, MX, NS, TXT, CAA and SOA records, analyses e-mail spoofing protection (SPF lookups and "all" policy, DMARC policy and reporting, MTA-STS), fetches the live TLS certificate from the domain's public IP (issuer, SANs, expiry, key, chain, TLS version, browser trust) and lists recent certificates from Certificate Transparency logs via crt.sh.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://dnscertificateexplorer.usefulweb.site/ (interactive tool at https://dnscertificateexplorer.usefulweb.site/tool)
- JSON API: POST https://dnscertificateexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://dnscertificateexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://dnscertificateexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://dnscertificateexplorer.usefulweb.site/mcp - tool `dns_certificate_explorer`

## Inputs
- domain (text, required): Domain
- certificateTransparency (boolean): Include Certificate Transparency history (crt.sh, slower)

## Method
- DNS queries via the server's resolver: A, AAAA, CNAME, MX, NS, TXT, CAA, SOA for the domain and TXT at _dmarc.<domain> and _mta-sts.<domain>.
- SPF (RFC 7208): one record allowed, max 10 DNS-querying mechanisms, policy from the "all" qualifier. DMARC (RFC 7489): p=, pct=, rua=.
- TLS: one connection to the first public IPv4/IPv6 address on port 443 with SNI; the certificate is verified against Node's trusted root store and the hostname (private addresses are never contacted).
- Certificate Transparency: crt.sh JSON for the exact domain, latest 25 entries (deduplicated by serial, precertificates included).