Network Tools

A network tool does not measure the internet. It sends one query to one authority and prints the reply. Knowing which authority answered, and which rule shaped that answer, is what makes a lookup a usable test.

DNS answers have size limits, and truncation is not absence

RFC 1035 puts hard numbers on the name space: "labels 63 octets or less names 255 octets or less", and in the same size-limit list "UDP messages 512 octets or less". A reply that does not fit is marked rather than silently shortened: "TC TrunCation - specifies that this message was truncated due to length greater than that permitted on the transmission channel." A NOERROR with no records is worth repeating over TCP before you call the record missing.

Field names are case-insensitive, and Host is not optional

RFC 9110 states the first rule plainly: "Field names are case-insensitive and ought to be registered within the "Hypertext Transfer Protocol (HTTP) Field Name Registry"". A header checker that compares names case-sensitively reports a present header as missing. One field is mandatory in a request: "A user agent MUST generate a Host header field in a request unless it sends that information as an ":authority" pseudo-header field." Repetition is legal, and combining is defined: "A recipient MAY combine multiple field lines within a field section that have the same field name into one field line, without changing the semantics of the message." Two Set-Cookie lines are a list, not a duplicate defect.

CORS is a set of response headers, and the preflight is a separate request

The Fetch standard defines it in one sentence: "The CORS protocol consists of a set of headers that indicates whether a response can be shared cross-origin." Anything beyond what an HTML form can send is checked first: "For requests that are more involved than what is possible with HTML's form element, a CORS-preflight request is performed, to ensure request's current URL supports the CORS protocol." And Access-Control-Allow-Origin "Indicates whether the response can be shared, via returning the literal value of the Origin request header (which can be null) or * in a response." A wildcard and a credentialed request do not combine, so a CORS tester has to send the real Origin.

Certificates, logs, registries and policies each have their own source of truth

RFC 8446 defines the transport: "This document defines TLS version 1.3." Certificate transparency supplies the audit trail, as "publicly auditable, append-only, untrusted logs of all issued certificates", append-only "technically achieved using Merkle Trees". Registration data has its own JSON format - RFC 9083 describes "JSON data structures representing registration information maintained by Regional Internet Registries (RIRs) and Domain Name Registries (DNRs)" - which is why RDAP is machine-readable where "WHOIS is a TCP-based transaction-oriented query/response protocol". A policy is a fallback chain: in CSP Level 3 "The default-src directive serves as a fallback for the other fetch directives", so a policy that sets only default-src has still decided about scripts.

Send the request in the HTTP API Tester, read the reply in the HTTP Header Checker, query the zone with the DNS Lookup, compare the policy in the CORS Tester, walk the chain in the SSL Certificate Checker, check the registration in the WHOIS Lookup, and write the policy with the CSP Builder.

Sources: RFC 1035, Domain Names - Implementation and Specification; RFC 9110, HTTP Semantics; WHATWG Fetch Standard, the CORS protocol; RFC 6962, Certificate Transparency; W3C Content Security Policy Level 3.