Tools
Every one of these answers a question we had to answer for ourselves first. They run on our own network, they need no account, and none of them reports on you.
RPKI
Check a prefix and origin AS against the validated ROA set our own routers use. Valid, invalid or not found, with the covering ROAs.
Open →DNSSEC
Ask a validating resolver whether a domain's DNSSEC chain checks out. Separates unsigned from broken, which is the distinction that matters.
Open →SPF
Read a domain's SPF record and say what is wrong with it: the ten-lookup limit, +all, terms after all, more than one record. Or build one.
Open →DMARC
Read a domain's DMARC record and say what it actually does. Or build one, from p=none to enforcement, without guessing at the tags.
Open →DKIM
Generate a DKIM key pair in your own browser — the private key never reaches us — and get the DNS record to publish. Or check a selector that is already live.
Open →DNS
Look up A, AAAA, MX, TXT, NS, CNAME, SOA and CAA for a name in one query, answered by a resolver that validates DNSSEC.
Open →Looking glass
Ping, traceroute and MTR from every city we serve, sent from our own address space.
Open →Why these
Route origin and DNSSEC are checked against the same data our own routers and resolvers use, so what you see here is what our network believes. The three mail records — SPF, DKIM and DMARC — are the ones that decide whether your mail arrives, are edited by hand in a registrar's text box, and fail in ways nobody finds out about until mail stops.
The DKIM generator makes the key pair in your browser. A generator that mints a signing key on a server has, for a moment, held your signing key, and you have no way to check what it did with it.