Free DNS, email and SSL checks with nameserver.lv

Nameserver.lv is a free toolkit for checking DNS, email and SSL: 15 tools with no registration, in Latvian, English and Russian, built by a team in Riga. The service is new, so there are no availability promises and no support desk behind it: these are tools that simply run in the browser.

There are plenty of tools there, but three of them solve problems people usually hit after the record is already published. Those are worth a closer look.

The SPF generator counts the limit before you publish

An SPF record carries a hard constraint: while evaluating it, a receiver may make no more than 10 DNS lookups. Cross that, and the answer is permerror, which most receivers treat exactly like a failed check. The unpleasant part is that you can cross the limit without touching your own record: it is enough for a provider to add one more include on their side.

The difficulty is that lookups are invisible to the eye. Every include costs at least one, but there may be several more inside it. A live example you can verify yourself:

include:mailgun.org
  -> include:_spf.mailgun.org
       -> include:_spf1.mailgun.org
       -> include:_spf2.mailgun.org
  -> include:_spf.eu.mailgun.org

total: 5 lookups out of 10

Mailgun alone eats half the budget. For comparison, the Google Workspace and Microsoft 365 records are flat right now, with no includes inside, so each costs exactly one lookup. A company using all three lands on 7 out of 10, and there is little room left.

The SPF generator expands that tree and shows the count while the record is still being assembled. That is the only moment when the mistake is cheap to fix: after publishing, you learn about it from delivery problems.

The DKIM key is created in your browser

A DKIM private key signs all of a domain's mail. Whoever holds it can send messages in your name, which is exactly why generating a key on someone else's website is a risky step: normally there is no way to tell whether the server kept a copy.

The DKIM generator removes that question: the key pair is created in the browser itself through WebCrypto, and the private key never reaches the server at all. You can check this without taking anyone's word for it. Open developer tools, the Network tab, and generate a key. No request carrying the key will appear, because the page's code contains no network calls at all.

The public key then goes into DNS as a TXT record, while the private one stays on the mail server. If a key leaks, you rotate it by changing the selector.

The TXT check looks beyond the domain itself

Most email policies live not at the domain root but in subdomains, and that is exactly where the common mistakes appear. A DMARC record placed at the apex instead of _dmarc does not exist as far as a receiver is concerned. Two SPF records on one domain are a permerror even when each is correct on its own.

The TXT check looks in one step at the domain and at _dmarc, _bimi, _mta-sts and _smtp._tls, and names every record it finds instead of printing it as a line of text. You immediately see what is in place, what is missing and what was put in the wrong spot.

Who this is for

These tools are not only for administrators. When company mail suddenly starts landing in the spam folder, the answer usually sits in one of those three records, and the check takes a minute. Everything is on nameserver.lv, with no registration and no charge.