Password Length

Generate a password to see the analysis.

Password Type

—

Character Count

—

Guesses Needed

—

Security Rating

—

Character Sets Used

none

Complexity Summary

—

• Use a unique password for every single system.
• Store credentials in an approved password manager.
• Enable multi-factor authentication wherever available.
• Prefer 16+ characters for administrative accounts.
• Never send passwords over unencrypted e-mail or chat.

Counting uppercase letters and symbols says little on its own. P@ssw0rd2024 ticks every box and still falls in seconds, because cracking tools try leaked passwords, dictionary words, names, dates and keyboard patterns long before anything else. So this works out how many guesses three different attacks would need and keeps the lowest, since an attacker gets to pick the easiest one: known patterns, the recipe the Generate tab builds passwords with, and plain brute force. The Generate tab runs this same check, so a password reads the same on both screens.

Length

—

Guesses needed

—

Each line is one server handing the message to the next. The time is how long that step took, so a big gap shows where a slow message got stuck. The first line is where it really came from, which is far harder to fake than the From address.

This reads what the receiving mail server already wrote into the headers: whether SPF, DKIM and DMARC passed, which servers handled the message, and what the spam filter decided. It runs entirely here, so the headers, the internal addresses and the IP addresses in them never leave this device. It can't re-check a signature or look up a DNS record. For a sender's live SPF, DKIM and DMARC setup, use Email health. A pass means nothing obvious is wrong, not that the message is genuine.

Status

Run a lookup to see results.

Browsers can't speak DNS directly, so each lookup goes to Cloudflare (1.1.1.1) and Google (8.8.8.8) over HTTPS. They see the name you look up and your IP address, nothing else. If the two answers differ, a change is probably still spreading, or the site gives different answers by region (common with CDNs). Results are cached by the resolvers for the record's TTL, so a fresh edit can take that long to show. The registrar and dates come from RDAP through rdap.org, which asks the domain's registry.

• MX says which servers receive the domain's mail.
• SPF lists the servers allowed to send for it. It's limited to 10 DNS lookups.
• DKIM publishes the key that proves a message wasn't altered.
• DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports.

Only the domain name is sent, to Cloudflare and Google DNS. DKIM can't be proven from DNS alone: a missing selector here may just be one this tool didn't guess.

Spamhaus, the most important list, doesn't answer queries that arrive through public DNS, so it can't be checked here honestly. Use the links below with the same IP.

A mail server should have a reverse DNS (PTR) name that resolves back to the same IP. Many receivers reject or down-rank mail from servers where it doesn't. Being on one small list rarely blocks mail by itself; being on several, or on a big one, usually does.