Internet Tools

Learn what WHOIS reveals about domain ownership, registration dates, expiry, nameservers, and domain status codes — with real examples for security research, competitive analysis, and domain recovery.

Gmail routes email based primarily on engagement signals — opens, clicks, spam complaints, and whether recipients move messages to Primary. Here's how the three-tier system works, what signals determine Promotions vs. Primary, why list segmentation improves deliverability, and how Outlook differs from Gmail.

HTTP/2 and HTTP/3 changed the transport layer — binary framing, header compression, multiplexing, QUIC — but the headers you see in a response inspector are mostly the same HTTP/1.1 headers. Here's what HTTP/2's HPACK compression and multiplexing actually do, what the :method/:path/:status pseudo-headers mean, how to identify which HTTP version served a response, and what the Alt-Svc h3 header signals about HTTP/3 availability.

BIMI's logo signals trademark ownership and DMARC enforcement — not email quality or sender reputation. It protects against spoofing the exact registered domain, not against lookalike domains (examp1e.com). Here's BIMI's four-layer authentication stack context, what VMC vs CMC actually certifies (trademark ownership, not email quality), why DMARC p=reject is the real security benefit in the BIMI requirement chain, and why major brands remain the primary BIMI adopters.

Your computer's DNS settings and your browser's actual DNS resolution might be using completely different servers — DNS over HTTPS (DoH), increasingly implemented at the browser level, can bypass OS-level DNS settings entirely. Here's why DoH/DoT exist (encrypting DNS queries for privacy), why "dig shows the new record but my browser doesn't" can happen due to separate resolver caches, and how DoH interacts with network-level DNS filtering.

A domain that never sends email is, paradoxically, an easy spoofing target — recipients have no way to know "this domain never sends mail" without DMARC explicitly saying so. Here's why p=reject can be applied immediately (with zero risk) to parked/non-sending domains and subdomains, how sp= protects subdomains separately from the primary domain's policy, and why BIMI specifically requires p=quarantine or p=reject, not p=none.

A website scoring 95 in a lab speed test can still feel slow to real users — lab tests run on powerful servers with fast connections and empty caches, while real users are on phones, on 4G, seeing your site for the first time. Here's the lab vs field data distinction, what LCP/INP/CLS actually measure, why slow TTFB sets a floor no client-side fix can overcome, and the specific changes that move each Core Web Vital the most.

A PTR record can say anything — anyone who controls a server can configure their reverse DNS to claim any hostname. FCrDNS (Forward-Confirmed Reverse DNS) verifies authenticity by checking that the PTR hostname resolves back to the original IP. Here's how to read ISP and datacenter naming conventions in PTR records, how reverse DNS reveals email header forgery, and why PTR record changes can indicate BGP hijacking.

Learn what download speed, upload speed, ping, and jitter measure, how to get accurate speed test results, and how to interpret your results against your ISP plan.

Every open port is a potential attack surface. Here's a practical reference of common ports — what they do, which should be publicly accessible, and which are commonly left dangerously exposed — with guidance on interpreting scan results.