NetQuery is a network investigation and troubleshooting platform for DNS, email delivery, SMTP, TLS, IP infrastructure and Microsoft 365. Use it on the web, in Microsoft Teams, Outlook, or Microsoft 365 Copilot to move from a domain, hostname or IP address to the checks that explain what is working and what is not.
Try NetQuery · Browse all network tools · Microsoft Marketplace · NetQuery for Microsoft 365 · Microsoft app compliance
NetQuery helps IT administrators, security teams, managed service providers, help desks, email administrators and developers investigate public internet infrastructure without bouncing between unrelated tools.
Start with a high-signal check, then pivot into the records and services behind the result. Typical investigations include:
- Why is email not being delivered?
- Are MX records pointing to the right mail provider?
- Is SPF valid, aligned and within the DNS lookup limit?
- Are DKIM and DMARC configured correctly?
- Is DNSSEC signed correctly from the child zone to the root?
- Can a public SMTP server be reached, and what capabilities does it advertise?
- Is a TLS certificate valid, and which protocols and ciphers are exposed?
- Does an IP address have consistent PTR and forward DNS?
- Which ASN or network owns an IP range?
- What subnet, broadcast address and usable host range correspond to a CIDR block?
| Area | NetQuery can help investigate |
|---|---|
| DNS | A, AAAA, CNAME, MX, NS, SOA, SRV, CAA, PTR and related public DNS records |
| Email authentication | SPF, DKIM, DMARC and BIMI configuration |
| DNSSEC | DS, DNSKEY, RRSIG, NSEC, NSEC3 parameters and chain-of-trust failures |
| Mail transport | SMTP reachability, EHLO capabilities, STARTTLS, certificates, MTA-STS and TLS reporting signals |
| TLS | Certificate chains, hostname validity, protocol support and cipher suites |
| IP investigation | ASN ownership, reverse DNS, forward-confirmed reverse DNS, geolocation and DNS blacklist signals |
| Network planning | IPv4 CIDR ranges, subnet masks, broadcast addresses and usable host ranges |
| Microsoft 365 | DNS and email diagnostics in Teams, Outlook and Microsoft 365 Copilot |
A useful first pass is MX → SMTP → SPF/DKIM → DMARC → TLS → PTR/FCrDNS. This separates routing, reachability, authentication, transport security and sender identity instead of treating “email is broken” as one problem.
Email delivery troubleshooting workflow
Check the authoritative DNS path first, then inspect the records you expect to exist. For DNSSEC problems, validate the chain of trust before drilling into DS, DNSKEY, RRSIG and authenticated denial-of-existence records.
DNS and DNSSEC troubleshooting workflow
Start with network ownership, reverse DNS and the actual CIDR boundaries, then pivot into reputation, geolocation or mail-sender identity as needed.
IP and CIDR investigation workflow
NetQuery accepts natural-language requests, direct domains or IP addresses, and focused command:value lookups.
mx:example.com
dmarc:example.com
tls:example.com
smtp:mail.example.com
Natural-language examples:
Check the mail configuration for example.com
Why might example.com fail DMARC?
Check TLS for mail.example.com
Audit example.com's email security posture
See lookup and command examples.
These public tools are useful starting points for common investigations:
- MX record lookup
- SPF record checker and validator
- DNSSEC chain-of-trust validator
- Authoritative DNS lookup
- SSL/TLS certificate and cipher check
- Forward-confirmed reverse DNS checker
- Reverse DNS (PTR) lookup
- CIDR range and subnet calculator
- All NetQuery tools
NetQuery brings public network diagnostics into the Microsoft 365 workflow where an incident is already being discussed. It supports Microsoft Teams chats and channels, Outlook and Microsoft 365 Copilot.
Install from Microsoft Marketplace · Microsoft 365 documentation
NetQuery operates against public DNS and internet-facing services. Private DNS zones and internal-only hosts are not queried.
Some Microsoft 365 lookups can be used without creating a separate NetQuery account. Protected reports and account-specific web functionality may require sign-in.
Yes, but it is broader than a single-record DNS checker. NetQuery connects DNS records to email authentication, SMTP, TLS, DNSSEC, IP ownership and related public infrastructure so an investigation can continue from one signal to the next.
Yes. NetQuery can help separate mail-routing problems from SMTP reachability, SPF/DKIM/DMARC authentication, TLS configuration and sender-identity issues such as PTR or forward-confirmed reverse DNS.
Yes. NetQuery is available through supported Microsoft 365 surfaces including Teams, Outlook and Microsoft 365 Copilot. Tenant policies and administrator approval can affect availability.
No. NetQuery is designed for public DNS and internet-facing services.
No. This repository contains public documentation, examples and product resources. The production NetQuery application is proprietary and its implementation source code is not published here.
Do not publish suspected vulnerabilities in a public issue. Follow the instructions in SECURITY.md.
- Documentation index
- Email delivery troubleshooting
- DNS and DNSSEC troubleshooting
- IP and CIDR investigation
- NetQuery for Microsoft 365
- Lookup and command examples
- Support
- Security reporting
- Contributing
This is the official public documentation and resources repository for NetQuery, published by NetQuery, LLC.
Documentation corrections, integration ideas and reproducible product feedback are welcome. See CONTRIBUTING.md.
Copyright © 2026 NetQuery, LLC. All rights reserved.