Free tool · no signup · DNS + TLS

Domain, SPF, DMARC & TLS Expiry Checker

Type a domain: see its DNS records, whether SPF and DMARC are actually published, and how many days are left on its TLS certificate. Useful right before a migration, a mail-sending change, or the day a cert quietly expires.

API live at dns.lifestep.io

Developer guide: command-line recipes →

GET /domain — live

How it works

  1. The response normalizes the submitted domain and returns resolves plus bounded A, AAAA, MX, NS, TXT, and CNAME results.
  2. It identifies TXT records beginning with v=spf1 and v=DMARC1 and exposes both boolean flags and the matching record text.
  3. ttl_hint is the smallest TTL observed across returned DNS queries, not a promise about every recursive resolver.
  4. The tls object comes from a certificate-verifying connection to port 443 and can include issuer, subject, validity dates, and days until expiry; failed checks return null with a note.

Frequently asked questions

What DNS records does this checker return?

It returns bounded A, AAAA, MX, NS, TXT, and CNAME results, plus a minimum observed TTL hint.

Does it fully validate SPF or DMARC policy syntax?

No. It detects records that begin with v=spf1 or v=DMARC1, but it does not evaluate SPF includes or fully validate either policy.

How is TLS certificate expiry checked?

The service performs a normal certificate-verifying connection to port 443 through a globally routable address and reads the verified certificate validity dates.

Why can DNS or TLS fields be null?

A lookup can time out, a record can be absent, or a verified TLS connection can fail. The note field describes degraded checks when available.

Is this a domain ownership or security report?

No. It does not provide registrar or WHOIS data, reputation history, or a security verdict.

Use it from the command line

curl -sS "https://dns.lifestep.io/domain?name=github.com" \
  | jq '{domain,resolves,has_spf,has_dmarc}'

Projected response fields for the requested domain, excluding volatile addresses and certificate dates:

{
  "domain": "github.com",
  "resolves": true,
  "has_spf": true,
  "has_dmarc": true
}

Privacy

The service keeps a bounded domain-response cache in process for 300 seconds. The cache is per process and is not a persistent database.

Turning domain checks into release gates? Define what blocks a deploy.

Use the agent operations guide to turn DNS, mail-policy, and certificate signals into explicit pass, review, and fail conditions instead of relying on an unreviewed script result.

Get the verification guide Review the API source