An SSL certificate checker and DNS inspector in one panel. Enter a domain to see when its certificate expires, who issued it, whether the intermediate chain is complete, and how its A, MX, TXT and CNAME records are configured. Expired certificates and missing chain links are the two failures that take sites down quietly — this surfaces both.
No signupRuns in your browserNothing uploaded
DNS & SSL CheckerLive
This tool is built for a wider screen — scroll sideways inside the frame, or turn your device.
How to use it
Four steps to a result
Enter a domain
Type the hostname you want to inspect. Check the exact host your users hit, including the www variant, since the two often have different certificates.
Read the certificate panel
Issuer, validity window, days remaining and the subject alternative names are listed together. Anything under thirty days remaining deserves a calendar entry.
Check the chain
An incomplete intermediate chain is the classic bug that works in your desktop browser and fails on Android and in curl. The chain view shows whether every link is being served.
Review the DNS records
A, AAAA, MX, TXT, NS and CNAME records are listed together so you can confirm mail routing, verification records and SPF entries are where you expect them.
Questions
Frequently asked questions
Enter the domain and read the validity window in the certificate panel, which shows the not-before and not-after dates plus the days remaining. Set a reminder well before the expiry date — most outages caused by certificates are not attacks, they are forgotten renewals.
Your server must serve not just its own certificate but the intermediate certificates linking it to a trusted root. Desktop browsers often cache intermediates and paper over the gap, so the site looks fine to you while Android devices, older clients and curl reject it outright.
Almost always the incomplete chain described above. Chrome may have cached the missing intermediate from another site you visited, so it fills the gap silently. Testing with a tool that does not share that cache is what exposes the problem.
At minimum an A or AAAA record pointing at your server, NS records for your nameservers, and — if you send email — MX records plus SPF, DKIM and DMARC TXT records. Missing DMARC is the most common reason legitimate mail lands in spam.
Automate it. Certificates from Let's Encrypt last ninety days and renew automatically, but renewal jobs fail silently more often than anyone expects. A monthly manual check on your critical domains catches a broken cron job before your users do.
Keep going
More free tools
Every one runs in your browser, with no account and nothing uploaded.