Privacy

tlspeek does not store what you type. A DNS checker uses the domain only for that lookup. A header check or MTA-STS policy fetch uses the URL only to make that request. The SPF, DMARC, password, and JWT forms run in the browser and do not send their contents. Those values are not written to a database, not written to application logs, and not used for analytics.

There are no accounts. The site does not set cookies. If you pick a light or dark theme, that choice is kept in localStorage on your device so the next visit can match it. You can clear it in the browser.

Checker requests are HTTP POSTs. The domain is in the request body, not the URL, so it is not part of the address a normal access log records. The Workers logs we enable record the route and errors such as a failed lookup. They are not given the domain or the selector.

Rate limiting keeps a short-lived counter for the connecting IP address in the memory of the worker that handled the request. That counter is not a history of lookups, and it is not written to disk. It exists so one client cannot turn the checker into a high-volume DNS client. Because workers do not share memory, the limit is per isolate. It resets when that isolate goes away.

DNS questions are sent to Cloudflare's public DNS-over-HTTPS service at 1.1.1.1. Header checks and the MTA-STS policy fetch resolve the name there first and stop if any answer is a private or reserved address. They then send a GET to the public URL. Cloudflare's resolver policy applies to the DNS query.

The DMARC generator does not contact the server at all. The record is assembled in the page.

No analytics product is installed. The dashed ad and affiliate areas are placeholders. They do not load a network, a pixel, or a script. If that changes, this page will say so before anything is requested.

Do not submit secrets. These tools need a public domain, sometimes a DKIM selector, or an http(s) URL on port 80 or 443. The header and TLS checks connect only after the name resolves to a public address.