ShakerScan
Install ShakerScan

Free checks · No account

Check a domain or your connection

DNS, email, HTTP and TLS facts for any public domain or IP address, measured by the same engine as shakerscan check. No account, no scores: just what was observed and how.

Options

A DKIM key can only be looked up by its selector, and selectors are never guessed. Leave empty to skip.

To test CORS on a specific path, enter a full URL such as https://example.com/api; the path is probed with a fixed foreign Origin.

Check your connection from a terminal

A terminal can also check the certificate this machine was given and raw DNS, which a browser cannot. One command runs the full report plus five checks on this machine; run it on the device and network you want to check. macOS and Linux.

curl -fsSL https://shakerscan.com/x | sh

Read the scriptSHA-256

Windows: there is no script. Use curl.exe in PowerShell with the commands below; for DNS, Resolve-DnsName or nslookup. Text instructions: curl https://shakerscan.com/check/dns.

More commands
  • curl -sL https://shakerscan.com/check/https

    Full report: connection, route, HTTPS, DNS resolver, and the checks below as commands. Up to 30 s.

  • curl https://shakerscan.com/check

    Short summary: IP, location, time zone, network, TLS, HTTP.

  • curl https://shakerscan.com/check/ip

    Just your IP address.

  • curl https://shakerscan.com/check/json

    The short summary as JSON.

  • curl https://shakerscan.com/check/dns

    Step-by-step DNS interception and DNSSEC test, including Windows nslookup.

  • curl -sv -o /dev/null https://connection.shakerscan.com/ 2>&1 | grep -i issuer

    Certificate issuer. Expected: an Amazon issuer (O=Amazon). Another issuer is a difference to review: often a company proxy or antivirus that decrypts HTTPS.

  • dig +norec @205.251.192.197 canary.probe.shakerscan.com CNAME | grep -E 'flags:|status:|CNAME'

    One UDP query to ShakerScan’s DNS server. aa and a CNAME: it answered. ra or other content: something else answered. REFUSED or a timeout: this query was refused or blocked (VPNs and firewalls do this).

  • dig x.t.probe.shakerscan.com | grep -E 'status:|SOA|SERVER'

    DNSSEC. The test name has a broken signature on purpose. SERVFAIL: consistent with validation. An address: your resolver did not validate it. NXDOMAIN: a negative answer, not a DNSSEC result (the SOA line names who sent it).

  • curl -sS "https://v6.probe.shakerscan.com/v1/leak?asn=0"

    Compares the network your other address family (usually IPv6) leaves from with this one; Check my connection fills in your network number and the family to test. Couldn't connect means the test did not reach it; it does not prove you have none.

  • curl -s "https://connection.shakerscan.com/v1/dns?probe=<id>"

    The DNS resolver result later, when the report printed “no lookup reached ShakerScan in time”.

Check a domain from a terminal: pipx install shakerscan, then shakerscan check example.com. Results saved with --json open on this page.

Each observation is a measured fact with the scope of the probe that produced it. The service makes no pass/fail judgment; the Review list is this page’s short reading of a few clearly risky values, the same as the command line shows.