# HTTPfy

> Free DNS, email-authentication, TLS certificate, WHOIS, IP/ASN and network diagnostics, usable in a browser or by AI agents over MCP.

MCP server (Streamable HTTP, no authentication): https://httpfy.io/mcp

## Agents

- [Setup for AI agents](https://httpfy.io/agents): install snippets for Claude, ChatGPT, Cursor, VS Code, Codex, Gemini CLI, Windsurf
- [Agent Skill](https://httpfy.io/agents/httpfy-network-checks/SKILL.md): when to use which tool

## MCP tools

- `dns_lookup`: Look up DNS records of one type (A, AAAA, CNAME, MX, NS, SOA, TXT, SRV) for a domain using public resolvers.
- `dns_propagation_check`: Query a domain on about 40 public resolvers in different regions and report which ones return which answers, to see whether a DNS change has propagated.
- `dnssec_check`: Validate the DNSSEC chain of trust for a domain from the root down (DS, DNSKEY, RRSIG) and report each zone as secure, insecure or broken.
- `mx_lookup`: List the mail exchanger (MX) records of a domain with their preferences.
- `spf_lookup`: Fetch the SPF record of a domain from its authoritative name server and list its mechanisms (ip4, ip6, include, redirect, all).
- `spf_validate`: Validate the SPF record of a domain: syntax, single-record rule, DNS lookup count (limit 10), void lookups, includes and the all mechanism.
- `domain_whois`: WHOIS registration data for a domain: registrar, dates, status and name servers (personal contact data is redacted by registries).
- `domain_expiry`: Registration and expiry dates of a domain, with the time remaining before it expires.
- `ssl_certificate_check`: Connect to a domain on port 443 and report the certificate chain: subject, issuer, validity dates, days remaining, SANs and chain details.
- `ping`: Ping a public host from httpfy servers (4 ICMP echo requests) and report packet loss and round-trip times. Useful to test reachability from outside your own network.
- `traceroute`: Traceroute to a public host from httpfy servers (up to 10 hops). Internal hops of httpfy's own network are masked.
- `ip_whois`: WHOIS / registry data for a public IPv4 address: ASN, network range, owner organisation and registry.
- `ip_blacklist_check`: Check whether a public IPv4 address is listed on common DNS-based blocklists such as Spamhaus, Barracuda and SpamCop.
- `mac_vendor_lookup`: Identify the manufacturer registered for a MAC address prefix (OUI) using the IEEE registry.
- `asn_lookup`: Look up the autonomous system (ASN) for a public IP address, or details for an ASN such as AS15169: name, country, announced prefixes and address counts.
- `bimi_check`: Check the BIMI record of a domain, whether DMARC meets BIMI requirements, and whether the SVG logo and certificate URLs are reachable and well formed.
- `caa_check`: Find the CAA records that apply to a domain (climbing to parent domains per RFC 8659) and list which certificate authorities may issue certificates.
- `certificate_transparency_search`: List certificates logged in Certificate Transparency for a domain (via crt.sh): issuer, validity window and names, with a summary by issuer.
- `dkim_check`: Check DKIM public keys for a domain. With a selector it checks that selector; without one it probes common selectors. Reports key type and RSA key length and flags weak or revoked keys.
- `dmarc_check`: Find and explain the DMARC record of a domain (policy, pct, rua/ruf, alignment) and flag weaknesses such as p=none or missing external report authorization.
- `dns_report`: Full DNS report for a domain: delegation from the root, every authoritative name server checked individually (reachability, recursion, TCP, consistency), SOA values, MX records and their reverse DNS, SPF, DMARC, DKIM and DNSSEC.
- `domain_health_report`: Grade a domain A to F across 11 checks (name servers, SOA, DNSSEC, MX, SPF, DMARC, CAA, HTTPS certificate, HTTP to HTTPS redirect, HSTS, IPv6), with a reason and fix for each failed check.
- `mta_sts_check`: Check MTA-STS (TXT record and the HTTPS policy file, mode and MX patterns) and the TLS-RPT reporting record for a domain.
- `port_check`: Check whether one TCP port on a public host is open, closed or filtered when tested from httpfy servers on the internet.

## Reference

- [DNS record types](https://httpfy.io/dns/records/)
- [HTTP status codes](https://httpfy.io/http-status/)
- [Port numbers](https://httpfy.io/ports/)
- [Subnet cheat sheet](https://httpfy.io/subnet/)
- [ASN directory](https://httpfy.io/asn/)
- [Research](https://httpfy.io/research/)
- [Data sources](https://httpfy.io/data-sources)