Short essays on how the internet works under the hood — networking concepts explained simply, the meaning behind IP and DNS data, and practical ways to use these tools.
MXToolbox is a dozen tools behind one search box. The free tool for each job, from SPF lookup counting to header tracing to live DMARC test messages, why our blocklist check queries seven lists instead of a hundred, and the one test MXToolbox still does best.
Read →One organisation assigns the number, another writes the description, a third decides whether anyone is exploiting it. Who the 549 assigning authorities are, what reserved and rejected mean, why over a third of one week's records still had no completed analysis two weeks later, and how to read a full record end to end.
Read →127.0.0.0/8 stops inside the network stack and 169.254.0.0/16 stops at the first router. Why the loopback block holds 16 million addresses, what a 169.254 address is really reporting, why fe80:: means the opposite thing in IPv6, and the localhost trap that makes a running server look dead.
Read →Removal is the last step, not the first. What the return code is telling you, which lists clear themselves within a day of the reports stopping, why a delisting stays invisible for hours after it lands, and what a request that actually gets actioned says.
Read →A scan hands you findings sorted by severity, which is a tie rather than a priority order. How to pull the IDs out of a messy export without the four-digit pattern that silently drops most of them, rank by confirmed exploitation instead of dread, and read the rows that come back with nothing to go on.
Read →Nothing in DKIM expires a key, so retiring one is a decision you make and a sequence you have to get right. Why the selector lets two keys coexist, how long the old one has to stay published before you touch it, what revoking does that deleting does not, and the 255-character limit that breaks the upgrade everyone eventually makes.
Read →The score is computed from the string beside it, so the string is the part that carries the information. What the eight base metrics mean, why CVSS rounds up and never down, how base, threat and environmental produce three different numbers from one flaw, and what v4.0 changed when it dropped Scope.
Read →Encryption hides your lookups from the network, never from the resolver reading them. What Cloudflare, Google and Quad9 have each put in writing about retention, which of them forwards a piece of your network address to every authoritative server it talks to, and why the resolver you configured may not be the one answering.
Read →