NetDetectHubGet the app
Explore more

Guide · 13 lessons

Learn how IP addresses, DNS, email records and HTTPS work

Each lesson takes about five minutes and explains one idea behind the tools on this site: what the result means, where the rule comes from, and a worked example you can follow line by line. The examples use the address ranges and domain names reserved for documentation, so nothing in them points at a real network. Every lesson lists the standards and guides it is based on, with a last-checked date, and ends with a three-question check and a link to the matching tool. Your progress is saved only in this browser.

Every rule is traced to the RFC, registry or official guide it comes from, so you can read the original yourself.

Your progress 0 of 13 read

Start learning

Module 1 IP addresses and your connection

IPv4 and IPv6, private and shared ranges, how location databases guess where an address is, what WebRTC reveals, and why port forwarding fails behind carrier-grade NAT.

  1. IPv4 vs IPv6: public, private and shared addressesAn IPv4 address has 32 bits, an IPv6 address 128. Your home network uses private IPv4 addresses from RFC 1918 and your router translates them to one public address. Some ISPs add a second layer of translation using the shared range 100.64.0.0/10.6 min read✓ Read
  2. How IP geolocation works, and why it is often wrongAn IP address carries no location. Registries record who holds an address block and in which country it is registered; ISPs can publish geofeeds; database vendors combine these with their own data. The result is good at country level, weaker for cities, and moved by mobile networks, CGNAT and VPNs.5 min read✓ Read
  3. What a WebRTC leak is and how to read the testTo set up direct calls, a browser collects ICE candidates: its own addresses (host), the public address a STUN server sees (server reflexive) and relay addresses (TURN). A leak means WebRTC reveals a public address that differs from the one your normal web traffic uses, for example the ISP address behind a split-tunnel VPN.5 min read✓ Read
  4. Port forwarding and CGNAT: why your server can't be reachedHome routers share one public IPv4 address by translating ports, and only replies to outgoing traffic get back in. A port forwarding rule maps one public port to one device. If the ISP adds carrier-grade NAT, the router's own address is not public, so a rule on your router alone cannot open the port.6 min read✓ Read

Module 2 DNS

How a name is turned into an address step by step, what each record type is for, and how TTL caching decides when a change is seen everywhere.

  1. How DNS resolution works, step by stepYour device asks a recursive resolver. If the answer isn't cached, the resolver asks a root server, which refers it to the TLD servers, which refer it to the domain's authoritative servers, which give the answer. Every answer is cached for its TTL, so most lookups skip most steps.6 min read✓ Read
  2. DNS record types explained: A, AAAA, CNAME, MX, TXT and moreEach DNS record has a name, a type, a TTL and a value. A and AAAA give addresses, CNAME makes an alias, MX names mail servers with a priority, TXT carries text such as SPF and DMARC, NS and SOA describe the zone itself, and CAA limits which certificate authorities may issue certificates.6 min read✓ Read
  3. DNS TTL and propagation: why changes take timeDNS changes don't travel anywhere: the new value is live on the authoritative servers at once, and resolvers keep serving the old one until their cached copy's TTL runs out. Lowering the TTL well before a change, and waiting out the old TTL, keeps the switch short.5 min read✓ Read

Module 3 Email authentication

SPF, DKIM and DMARC: who may send for a domain, how a signature proves a message is intact, and how to move a domain to an enforced policy safely.

  1. SPF records explained: mechanisms, qualifiers and the 10-lookup limitSPF is a TXT record starting with v=spf1 that lists who may send mail using a domain in the envelope sender. Receivers evaluate the terms left to right; include, a, mx, ptr, exists and redirect each cost a DNS lookup, and more than 10 in total makes SPF fail with a permanent error.6 min read✓ Read
  2. DKIM signatures explained: selectors, keys and what gets signedThe sending server signs chosen headers and a hash of the body with a private key and adds a DKIM-Signature header. The receiver reads d= (domain) and s= (selector), fetches the public key from s._domainkey.d in DNS and checks the signature. Keys must be at least 1024 bits and should be 2048.5 min read✓ Read
  3. DMARC policy rollout: from p=none to p=reject safelyDMARC passes when SPF or DKIM passes for a domain aligned with the From address. A domain publishes a TXT record at _dmarc with a policy: none (monitor), quarantine or reject. Starting at p=none with reports, fixing every legitimate sender, then enforcing is the path RFC 9989 describes.6 min read✓ Read

Module 4 Websites and subnets

What each redirect status code tells browsers and search engines, how HTTPS certificates are issued and logged, and how to work out subnet sizes from a prefix.

  1. HTTP redirects explained: 301, 302, 307 and 308301 and 308 mean moved permanently; 302 and 307 mean moved temporarily. 307 and 308 forbid changing the request method; 301 and 302 allow old clients to turn POST into GET. Google treats 301 and 308 as a signal that the target should be the canonical URL, and 302, 303 and 307 as temporary.5 min read✓ Read
  2. How HTTPS certificates work: validation, logs and lifetimesA certificate binds a domain name to a public key and is signed by a certificate authority after the CA checks control of the domain. Public CAs log every certificate in append-only Certificate Transparency logs. Let's Encrypt certificates last 90 days today, 64 days from 10 February 2027 and 45 days by February 2028.6 min read✓ Read
  3. Subnet masks and CIDR: counting addresses in a networkIn CIDR notation the number after the slash is how many leading bits name the network. A /p IPv4 network has 2^(32−p) addresses; with the network and broadcast addresses reserved, 2^(32−p) − 2 are usable, except /31 and /32. Splitting a network adds bits to the prefix and halves the block for each bit.6 min read✓ Read

These guides explain how the internet's plumbing works, using the published standards (RFCs) and official documentation. Each guide shows the date it was last checked.

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.