---
name: heade-rs
description: "Look up any domain, IP address or network (AS number) with heade.rs: where it's hosted, its DNS and DNSSEC, registration, email security (SPF, DMARC, MTA-STS), TLS certificate, security headers, tech stack, open ports, and which AI crawlers and agents it supports. Use when asked where a site is hosted or who runs an IP, to debug DNS or email deliverability, to check a site's headers or certificate, to find what a site is built with, or to audit its robots.txt, llms.txt and MCP support."
license: Free to use; heade.rs needs no account or key.
metadata:
  author: Colin Armstrong
  homepage: https://heade.rs
---

# heade.rs

heade.rs looks up a domain, an IP address or a network (AS number) and reports on it in one go. Every lookup is a URL: `https://heade.rs/<domain | IP | AS number>`.

## How to look something up

Ask for Markdown. It's the report a person sees, without the page around it:

```sh
curl -s -H "Accept: text/markdown" https://heade.rs/github.com
curl -s -H "Accept: text/markdown" https://heade.rs/1.1.1.1
curl -s -H "Accept: text/markdown" https://heade.rs/2606:4700::1111
curl -s -H "Accept: text/markdown" https://heade.rs/AS13335
```

- Pasted URLs and uppercase names redirect to the lookup's own URL, so pass `-L` to curl: `curl -sL -H "Accept: text/markdown" https://heade.rs/https://github.com/about` looks up github.com.
- `curl https://heade.rs/api/<query>` returns the same report as JSON, with every field. It's several times longer than the Markdown, so use it only when you need to pick fields out, for example with `jq`.
- A lookup takes a few seconds, since most of it is fetched live. Don't repeat one within a few minutes: many sources are cached for 5 minutes or more.
- The limit is 30 lookups a minute per client. A 429 means wait a minute.
- There are no `.md` URLs. `https://heade.rs/example.md` looks up the domain example.md, because .md is Moldova's top-level domain.

If you have an MCP client, the same lookup is a tool: add `https://heade.rs/mcp` (Streamable HTTP, no sign-in) and call `lookup` with `{"query": "github.com"}`.

## What a report covers

A domain's report has these sections. An IP address gets the hosting lines, Exposure and its registry allocation.

- **Hosting:** the address, its network (AS number and name), BGP prefix, RPKI status, location, and the cloud region, CDN, crawler, relay or Tor exit it belongs to.
- **Website:** the front page's title, status, host and CDN.
- **Tech stack:** server software, frameworks, CMS and plugins, libraries, with versions where the site gives them away, each checked for end of life and known vulnerabilities; how the page is rendered and cached; scripts loaded from other sites.
- **AI & agents:** which AI crawlers robots.txt lets in, which AI products can cite the site, whether agents get Markdown, llms.txt, and the MCP servers, API catalogs, agent skills and WebMCP tools it offers.
- **Email:** the mail provider, SPF, DMARC, MTA-STS, TLS-RPT and BIMI.
- **Exposure:** open ports, software and possible CVEs, from Shodan InternetDB.
- **Registration:** registrar, dates and status (RDAP or WHOIS), or the regional registry's record for an address.
- **DNS:** the records, and whether they're signed with DNSSEC.
- **Certificate** and **Security:** the certificate from Certificate Transparency, a grade for the security headers, HSTS, HTTP/3, ECH, CAA and security.txt.
- **Response headers:** the front page's headers and redirects.

A network's report covers its prefixes and address space, RPKI and ASPA, upstreams and peers, internet exchanges, peering policy and registration.

## Tips

- To answer "where is X hosted?" or "who runs this IP?", the first lines of the report are enough: address, network, location and hosting.
- For email deliverability, read the Email section, then the DNS section's TXT and MX records.
- Registration data comes from registries, so privacy services often hide the owner. Say so rather than guessing.
- Each report starts with front matter whose `url` is its page on heade.rs. Link to it when you cite the report.
- The route and live latency sections are measured from a browser, so they appear only on the web page.