Clean, ad-free sysadmin tools — DNS, email authentication, TLS, certificates, whois, network, and everyday utilities. Pure HTML/CSS/JS on the frontend with a handful of Cloudflare Pages Functions for the lookups that need a server. No logs. No tracking. No ads.
Live: https://sysadminstuff.net
- Lookup — A, AAAA, MX, TXT, NS, CNAME, SOA, PTR, SRV, or ALL, via Cloudflare DNS-over-HTTPS. IP input auto-switches to reverse (PTR).
- Propagation — the same record across Cloudflare, Google, and DNS.SB, with a consistency verdict. Runs entirely in your browser (these are the public resolvers that expose a browser-usable JSON + CORS DoH API).
- CAA — which CAs may issue certificates for a domain (RFC3597-parsed).
- DNSSEC — signed/unsigned status from the AD flag + DS/DNSKEY presence.
- SPF — parsed mechanisms with plain-English explanations and a policy summary.
- DMARC — every tag explained, policy badge (NONE / QUARANTINE / REJECT), report addresses.
- DKIM — look up any selector, key type and bit length, testing-mode warning.
- MX — priority-ordered hosts with resolved IPs and PTR records.
- Header Analyzer — paste raw headers to trace the routing path, per-hop delays, and SPF/DKIM/DMARC results. Runs entirely in your browser.
- Blacklist — checks an IP against 15 DNS blacklists.
- Builder — generate SPF and DMARC TXT records from a form.
- HTTP Headers — all response headers plus a 7-point security-header scorecard.
- Redirects — the full redirect chain, hop by hop, with status codes.
- TLS Grade — protocol/cipher probe and an A–F grade.
- ASN Lookup — ASN or IP details and announced prefixes (bgpview.io).
- Subnet Calculator — network/broadcast/mask/range/host-count. 100% in-browser.
- CIDR Tools — is-IP-in-CIDR check and split a CIDR into subnets.
- Geo — approximate IP geolocation (ipwho.is).
- Reverse DNS — PTR lookup with forward-confirmation.
- Lookup — certificate history via crt.sh (validity, SANs, issuer, expiry).
- Decode PEM/CSR — paste a certificate or CSR and see subject/issuer/SANs/validity/key/signature, parsed entirely in your browser (never uploaded).
- RDAP-based whois for domains and IPs.
- Microsoft 365 / Entra tenant lookup — given a domain, resolves the tenant ID (GUID), brand name, and Managed vs. Federated (ADFS) identity, and classifies the cloud environment: Commercial / GCC / GCC High / DoD (via OpenID Connect metadata
tenant_region_sub_scope+ cloud instance). Also lists other domains in the tenant. Uses only public, unauthenticated Microsoft endpoints — no login required.
- Cloud IP — which cloud owns an IP, with exact AWS region/service (from AWS's published ranges) or ASN-based provider detection for the rest.
- Fingerprint — the hosting/CDN, email, and DNS provider behind a domain (inferred from CNAME/MX/NS). Runs in your browser via DoH.
- ARN — break an AWS ARN into partition/service/region/account/resource.
- Password generator — length + character sets, with an easy-to-read mode that drops ambiguous characters (I l 1 i O 0 o |).
- Passphrase generator — N words from a bundled EFF wordlist, with separator/capitalize/number/symbol options and an entropy readout.
- UUID v4 generator.
- Base64, URL Encode, JWT Decoder — encode/decode/inspect locally.
- Hash (MD5, SHA-1/256/384/512), Epoch converter, Cron explainer, Chmod calculator, JSON formatter, Base Convert (hex/dec/oct/bin), Regex tester. Nothing you type leaves your browser.
sysadminstuff.net does not log, store, or track queries. No analytics. No cookies. No ads. The utility tools (JWT decoder, Base64, URL encode, subnet calculator) run entirely in your browser and never transmit data. See PRIVACY.md for full details.
The page makes no external asset requests at all — the IBM Plex fonts are self-hosted (css/fonts/*.woff2, SIL OFL) and every script/style is served from the same origin. Nothing (not even a font request) leaks to a third party on page load.
- Cloudflare DNS-over-HTTPS — DNS lookups & blacklist queries
- crt.sh — certificate transparency logs
- RDAP via rdap.org / ARIN — whois data
- ipwho.is — IP geolocation
- bgpview.io — ASN / prefix data
- Microsoft public endpoints (login.microsoftonline.com/.us OIDC metadata, GetUserRealm, Autodiscover) — M365/Entra tenant lookup, no auth
- DNS blacklists: Spamhaus, SpamCop, Barracuda, SORBS, UCEPROTECT, Mailspike, SpamRats, and others
The static files and the Pages Functions run together under Wrangler:
npx wrangler pages dev .Then open the printed local URL. No npm install is required for the frontend — it is plain JS.
A dependency-free smoke-test suite lives in tests/:
# Pure-logic unit tests (no network, runs in plain Node):
node tests/smoke.mjs
# End-to-end checks against a running `wrangler pages dev` instance:
npx wrangler pages dev . & # in one terminal
node tests/e2e.mjs # in another (defaults to http://localhost:8788)node tests/smoke.mjs exits non-zero on any failure, so it is safe to wire into CI. See tests/README.md.
Hosting is effectively free: static files are unlimited on Pages, and the Functions run on the Workers free tier — a hard 100,000 requests/day cap that fails closed (the API tools return errors past the limit; they never bill you). Stay on the free plan and there is no surprise-bill scenario.
The real concern is abuse of the API endpoints — several proxy third-party services (/api/crtsh, /api/rbl, /api/asn, /api/tenant, /api/headers, /api/tls) that could rate-limit or ban your IP under load. Two defenses:
-
Code-level (already in the repo):
functions/_middleware.jsrestricts/api/*to read methods (POST → 405), rejects oversized URLs, and requires a same-origin browser fetch (Sec-Fetch-Site) — socurl, scripts, and other sites are turned away with a 403. It's stateless, so it's free and always on. (This stops casual/scripted abuse; a determined attacker can still forge the header, which is what the rate-limit rule below is for.) It also edge-caches successful GET responses per endpoint (crtsh/asn/whois/tenant 1h, rbl/tls 10m, headers 5m) via Cloudflare's Cache API, so repeated lookups of the same domain/IP are served from cache and never re-hit the upstream. Responses carryX-Cache: HIT|MISS. -
Rate limiting (set this up once, free): In the Cloudflare dashboard for the zone → Security → WAF → Rate limiting rules → Create rule:
- If incoming requests match:
URI Pathcontains/api/ - Rate:
20requests per10seconds, counting by client IP - Action: Block (or Managed Challenge) for
60seconds
The free plan includes one rate-limiting rule — this is a good use of it. Adjust the numbers to taste; 20/10s is generous for a human but stops a script hammering your quota.
- If incoming requests match:
- Push this repo to GitHub.
- Cloudflare Pages dashboard → Create project → connect the GitHub repo.
- Build settings: no build command, output directory
/. - Add the custom domain
sysadminstuff.net(already on Cloudflare — DNS auto-configures). - Functions in
functions/deploy automatically. - Every push to
mainauto-deploys both the static files and the functions.
index.html privacy.html wrangler.toml
css/style.css
js/ core.js app.js dns.js email.js web.js network.js cert.js whois.js m365.js cloud.js utils.js tools.js
lib/ parse.mjs
functions/ _middleware.js api/ whois.js rbl.js tls.js headers.js asn.js tenant.js crtsh.js
tests/ smoke.mjs e2e.mjs README.md
Issues and PRs welcome. Guidelines:
- No build step and no frontend dependencies — keep it plain HTML/CSS/JS.
- Never log user input in a Pages Function (query params, URLs, IPs). See the no-logging rules in PRIVACY.md.
- No analytics, telemetry, cookies, or third-party scripts. Fonts are self-hosted; the page loads no external assets.
- Add or update a smoke test for anything you change.
Apache-2.0 with the Commons Clause — see LICENSE.
This is source-available, not OSI "open source". You may use, modify, and self-host it freely (including internally at a company). What you may not do is Sell it — that includes hosting it as a paid product or service, or selling support whose value derives substantially from this software. Everything else Apache-2.0 permits.