The Email DNS check looks up a domain's MX, SPF, DKIM and DMARC records and explains them in plain language. It flags common mistakes, such as multiple SPF records, more than 10 SPF DNS lookups or a missing DMARC policy, and each result appears as soon as its check finishes. DKIM keys are found by trying common selector names, and you can also check your own selector.

Paste a PEM certificate, certificate chain or certificate signing request into the Certificate & CSR decoder to see its subject, alternative names, issuer, validity dates, key type and size, and fingerprints.

The Password generator creates random passwords in your browser, and they're never sent to our servers. Choose how many passwords you need, their length and the character sets, optionally excluding look-alike characters such as 0, O, 1 and l. Or start from a preset, such as five 24-character passwords without look-alikes, an API secret or a PIN. Your settings are kept in the URL, so you can bookmark your favourite setup.

Use the Unix timestamp converter to turn a timestamp into a readable date or a date into a timestamp. Seconds, milliseconds, microseconds and nanoseconds are detected automatically. Results are shown in UTC, your local time and any timezone you choose, along with the relative time and ISO week. The current timestamp is shown at the top, ready to copy.

URL, Base64 and HTML entities encoding each have a single utility with an Encode/Decode toggle and a Swap button that turns the output into new input. Base64 now handles any UTF-8 text, including emoji and accented characters, and also decodes URL-safe Base64. HTML entity decoding supports all named and numeric entities. Links to the old encode and decode utilities still work.

The Hash generator shows the MD5, SHA-1, SHA-256, SHA-512 and RIPEMD-160 hashes of your text as you type, each with its own copy button. It replaces the separate hash utilities, whose old links now open the Hash generator.

Use the Punycode converter to convert an internationalized domain name to its ASCII (xn--) form and back. Each non-ASCII character is highlighted with what happens to it during conversion, and you're warned when decoding gives back a different name or when a label mixes scripts, a common sign of a look-alike domain. When you paste a URL or email address, only the host is converted.

Paste any text into the Unicode inspector to see each character with its code point, name, Unicode block and script, UTF-8 bytes, and escapes for HTML, JavaScript, PHP and URLs. Invisible characters, unusual whitespace and characters that look like ASCII, such as a non-breaking hyphen or a Cyrillic "а", are highlighted so they're easy to spot.

DNS lookup now checks whether a domain's authoritative nameservers return the same answer. The results show which servers agree, where records differ, and when a nameserver could not be checked.

Use the app switcher in the Utilities menu to open another Chief Tools app directly. You can move from a utility to the app you need without returning to the main Chief Tools site.

Open Search to find a utility by name and go straight to it. The command palette also lets you browse available tools with the keyboard.

Choose a light or dark appearance for Utilities from the theme control in the main menu, or select System to follow your device preference. Your choice is remembered as you move between Utilities pages.

In DNS lookup, prefix a domain with one or more record types to choose what to query without selecting the type buttons first. For example, MX,TXT:example.com looks up both MX and TXT records.

The DNS, PTR, WHOIS, and RDAP lookup pages now have tabs that carry your current query to another applicable lookup. Enter a domain, IP address, or ASN, then switch tools to inspect it from another angle. Tabs for unsupported query types are unavailable.

Use RDAP lookup to inspect registration and network information for a domain, IPv4 or IPv6 address, or ASN. View a readable summary or switch to the raw JSON response.

DNS lookup now validates DNSSEC signatures and shows whether the returned records are signed and valid, unsigned, or fail validation. Use the result when checking a domain's DNSSEC configuration.

Integrations can retrieve structured DNS lookup results with GET https://dns.chief.tools/api/lookup. Supply a domain in query and comma-separated record types in type; set include_log=true when you also need the lookup trace.

DNS lookup can now request multiple record types in one lookup and follow CNAME targets outside the original domain. This helps you inspect a domain's related records and the destination behind an alias in one result.

Use the ULID generator to create Universally Unique Lexicographically Sortable Identifiers. Copy a generated value for use in an application or data workflow that needs a sortable identifier.

You can now select YAML syntax highlighting in the Paste tool. Shared YAML configuration is easier to read with highlighting suited to the format.