Frequently Asked Questions

DNScope is a free browser-based collection of 20+ DNS and network tools — DNS lookups, WHOIS, subdomain discovery, port scanning, email-authentication audits (SPF/DKIM/DMARC/BIMI), DNSSEC checks, IP geolocation and more. Everything runs client-side in your browser against public DNS-over-HTTPS resolvers and open APIs. There is no DNScope backend.

Yes, 100% free with no ads, no signup, no API keys and no rate limits imposed by us. The only limits are the ones on the public APIs we call from your browser (typically hundreds of queries per minute per IP).

No. DNScope has no accounts, no login, no email collection. You can use every tool immediately.

Yes — you may use DNScope for professional work such as security audits, IT operations, brand-protection monitoring and email-deliverability troubleshooting. See the Terms of Service for the details.

Any modern browser released in the last two years: Chrome, Edge, Firefox, Safari, Brave, Vivaldi. Some features (DKIM key matching) rely on the Web Crypto API which is available in all of these.

DNScope itself has no server, so we cannot log your queries — they never touch our infrastructure. Individual requests do reach the public services we call (Google, Cloudflare, rdap.org, Shodan InternetDB, ipwho.is, crt.sh, corsproxy.io). Each of those has its own privacy policy. We use Google Analytics 4 to count page-views and count how often each tool is used, but never send domain names, IPs or other user input to Analytics.

The DNS Lookup tool supports A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, DS, DNSKEY, NAPTR, SSHFP and TLSA. The Raw DoH Query tool accepts any record type by name or by numeric type code, including uncommon ones like HTTPS, SVCB, OPENPGPKEY, URI, LOC and SMIMEA.

By default DNScope queries Google's public DNS-over-HTTPS (dns.google/resolve) for most lookups. Propagation checks and the resolver benchmark also query Cloudflare, Quad9, AdGuard, Mullvad and OpenDNS. You can pick a specific resolver in the Raw DoH Query tool.

The Subdomain Finder does active DNS brute-force against a wordlist — fast but only finds subdomains that match your list. Certificate Transparency reads public CT logs (crt.sh) for every TLS certificate ever issued for the domain. That is passive and much more thorough — it often surfaces internal-looking staging, admin and dev subdomains that never appear in wordlists.

No. Live TCP port scanning is impossible from a browser (browsers can't open raw TCP sockets). The Port Scan tool queries Shodan's free InternetDB API, which returns the ports Shodan saw open during their most recent internet-wide scan — usually within the last week. For a live nmap-style scan you need a backend.

Geolocation data comes from ipwho.is. Country and ASN are almost always correct. City-level accuracy is typically within 10-50 km for consumer ISPs and less accurate for mobile carriers, VPNs and CGNAT deployments.

A DNSBL (DNS-based Blocklist) is a list of IP addresses known to send spam or abuse. If your mail server's IP is on Spamhaus, SpamCop, Barracuda or similar lists, mail from that IP will be rejected or filtered by many providers. Use the Blacklist Check whenever mail is bouncing or landing in spam and you suspect the sending IP has reputation issues.

Six checks are combined into one 0–100 score: SPF (20 pts), DMARC (25 pts), DKIM presence at common selectors (15 pts), MTA-STS policy validity (15 pts), DNSSEC delegation (15 pts) and BIMI SVG validity (10 pts). Grades are A+ ≥ 95, A ≥ 85, B ≥ 70, C ≥ 55, D ≥ 35, F below that. The score reflects configuration quality — not real inbox placement or IP reputation.

SPF has a hard limit of 10 DNS lookups per record (RFC 7208). Every include: or a: or mx: mechanism counts. When you use a couple of email providers plus your own MX, you can easily hit 10. SPF flattening replaces include: chains with the actual IPs, keeping the record under the limit. The SPF Analyzer tool shows exactly how many lookups your current record uses and where the biggest chains live.

p=none is monitor-only: receivers still deliver failing mail. That's the right starting point when you first enable DMARC, so you can see reports without risking legitimate mail being blocked. After 2–4 weeks of clean rua reports, move to p=quarantine, then to p=reject. The Deliverability Score penalises p=none as a partial credit.

Yes — the DKIM matcher runs entirely in your browser via the Web Crypto API. Your private key is never uploaded anywhere. It's used locally to derive the public key, which is then compared with the p= value in the DNS DKIM record. Nothing leaves the browser except the DNS query for the DKIM record itself.

Browsers enforce CORS: a site's response headers can only be read from JavaScript if that site sends an Access-Control-Allow-Origin header allowing your origin. Big consumer sites (Facebook, Google, LinkedIn) block this on purpose. DNScope falls back to a public CORS proxy (corsproxy.io) automatically — those results are labelled 'via proxy'.

Same CORS reason as HTTP Headers. If the target site's server doesn't allow cross-origin reads, the browser blocks the response. DNScope tries the CORS proxy fallback automatically.

In your browser's localStorage on your own device. Nothing is uploaded. Clearing your browser data removes it, and it does not sync to other browsers. You can export the history as JSON from the DNS Lookup page and re-import it in another browser.

Yes. The project is a static React + Vite app. Clone it, run npm install and npm run build, and deploy the dist/ folder to any static host — Netlify, Vercel, Cloudflare Pages, GitHub Pages, S3 + CloudFront, plain nginx. No backend or database is required.

Not currently — DNScope is browser-only. Every tool calls open public APIs (Google DoH, Cloudflare, rdap.org, Shodan InternetDB, etc.) directly from your browser, so you can just call those APIs yourself if you want programmatic access.