DEV Community: Rasika Dangamuwa

The SPF 10-Lookup Trap: Why Transactional Emails Land in Spam

Rasika Dangamuwa — Wed, 23 Sep 2026 00:31:37 +0000

You wire up Google Workspace for team mail, plug in SendGrid for password resets, add Zendesk for support, and link HubSpot for newsletters. Each onboarding checklist ends with the exact same line: Add this include to your SPF TXT record.

You paste them together, save DNS, and everything appears fine. Then customer complaints roll in: corporate clients with strict mail servers never receive their login emails. When you inspect the bounce headers, you spot the culprit:

550 5.7.23 Resent-Message rejected: SPF PermError: too many DNS-lookups

If your DMARC policy is set to p=reject or p=quarantine, an SPF PermError fails DMARC evaluation immediately. Here is why this happens, how the math works, and how to fix it before delivery tanks.

The RFC 7208 10-Lookup Limit

Receiving mail transfer agents (MTAs) evaluate your SPF record against RFC 7208. Section 4.6.4 specifies a hard limit: an SPF check must not perform more than 10 DNS queries that require resolution.

Why 10? Bad actors can weaponize SPF for DNS reflection attacks. If an attacker forges mail from a domain whose SPF references dozens of external zones, receiving servers flood those nameservers with recursive queries just to verify one spoofed message.

The 10-lookup rule prevents abuse, but it catches developers off guard because nested lookups count against your domain quota, not the vendor’s.

Which Mechanisms Count?

Not every token in an SPF string incurs a lookup:

Consumes 1 lookup: include, a, mx, ptr, exists, redirect
Zero lookups (free): ip4, ip6, all

Consider this typical apex record:

v=spf1 include:_spf.google.com include:sendgrid.net include:mail.zendesk.com include:spf.protection.outlook.com -all

On paper, that looks like 4 lookups. In reality:

include:_spf.google.com (1) queries _netblocks.google.com (2), _netblocks2.google.com (3), and _netblocks3.google.com (4).
include:spf.protection.outlook.com consumes another 1-2 recursive lookups.
include:mail.zendesk.com resolves its own SPF tree.
include:sendgrid.net resolves SendGrid’s delivery cluster.

By the time the MTA follows the third include, your lookup counter hits 11. Evaluation halts immediately and outputs PermError.

If you are assembling records across multiple providers or parsing an existing line, you can use the browser-based SPF Record Generator and Parser to preview vendor presets, validate CIDR notation, and inspect your total mechanism count before committing DNS changes.

The Void DNS Lookup Trap

RFC 7208 Section 4.6.4 also enforces a Void Lookup Limit.

If an MTA queries a domain in an include: or a: mechanism and receives NXDOMAIN (non-existent domain) or NODATA (empty response), RFC 7208 caps these at at most 2.

When an old marketing or transactional provider shuts down an SPF endpoint, that single dead include consumes half your allowance. Two defunct includes trigger an instant PermError, even if your total lookup count is only 4.

Anti-Pattern: Multiple SPF Records

When records grow long, a common reflex is creating a second TXT record:

TXT @ "v=spf1 include:_spf.google.com ~all"
TXT @ "v=spf1 include:sendgrid.net -all"

Never do this. RFC 7208 Section 3.2 explicitly states a domain MUST NOT have multiple v=spf1 TXT records. If an MTA sees more than one SPF record on the same host, it immediately returns PermError. All directives must live in a single record.

How to Fix It

1. Subdomain Delegation (Recommended)

Instead of authorizing every third-party service on your root apex (company.com), delegate dedicated subdomains:

Staff email: company.com -> v=spf1 include:_spf.google.com ~all (4 lookups)
Transactional: mail.company.com -> v=spf1 include:sendgrid.net ~all (2 lookups)
Marketing: news.company.com -> v=spf1 include:servers.mcsv.net ~all (2 lookups)

This isolates reputation, simplifies DMARC alignment, and avoids the 10-lookup ceiling.

2. SPF Flattening

If you must send from apex, replace recursive include: domains with their static IP ranges (ip4:198.51.100.0/24). Because ip4 and ip6 take zero lookups, you can list many blocks safely. However, you must monitor vendor IP changes and update your records when ranges rotate.

Summary Checklist

Keep total query depth strictly under 10.
Prune decommissioned vendor includes immediately to prevent void lookup penalties.
Consolidate into a single TXT record starting with v=spf1.
Delegate dedicated subdomains for automated email streams.

When reviewing your DNS configuration, test syntax with the Nutilz SPF Record Generator alongside dig TXT yourdomain.com to verify your authentication headers resolve cleanly.

Why File Hashes Fail to Match: 5 Checksum Traps Every Developer Hits

Rasika Dangamuwa — Tue, 22 Sep 2026 00:32:31 +0000

You pull down a compiled binary, container archive, or release tarball from a distribution server. You run sha256sum artifact.tar.gz, copy the hex string, and compare it against the checksum published in the release notes.

The strings do not match.

Before you panic about a compromised mirror or a man-in-the-middle attack, consider the more mundane reality: file hashes are hyper-sensitive to byte-level environmental shifts. A single flipped bit or invisible header field scrambles the entire 256-bit digest due to the avalanche effect.

Here are the five most common traps that cause checksum mismatches in production environments and how to troubleshoot them.

1. CRLF vs. LF Line-Ending Normalization

The most common trap when hashing scripts, configuration files, SQL dumps, or JSON fixtures is carriage return normalization.

On Linux and macOS, newlines are represented by a single byte: line feed (0x0A, LF). On Windows, newlines default to two bytes: carriage return plus line feed (0x0D 0x0A, CRLF).

If a developer checks out a repository with git config core.autocrlf true, Git silently converts LF to CRLF in the working tree. Even a tiny configuration file will yield an unrecognizable digest:

# File with LF
printf "server=prod\nport=8080\n" | sha256sum
# b4c6df44d65008cf...

# File with CRLF
printf "server=prod\r\nport=8080\r\n" | sha256sum
# d7a810b427cf63bc...

To verify whether line endings caused your mismatch, run file <filename> or inspect byte codes with head -n 2 <filename> | od -c.

2. The Invisible UTF-8 Byte Order Mark (BOM)

Certain Windows editors and PowerShell redirection operators (like > in older PowerShell 5.1 sessions) prepend a 3-byte Byte Order Mark (0xEF 0xBB 0xBF) to UTF-8 text files.

To text editors, the file looks identical. To a cryptographic hash function, those three extra bytes sit at index zero:

# Check the first 8 bytes of the file in hex
xxd -p -l 8 config.json
# If you see efbbbf at the beginning, a BOM was injected

Strip the BOM using sed -i "1s/^\xef\xbb\xbf//" config.json before verifying.

3. Archive Non-Determinism in Tar and Zip Files

If you compress the exact same folder of source code on two different machines, the resulting .tar.gz or .zip archives will almost never share the same SHA-256 hash.

Standard archive tools store filesystem metadata inside the archive headers:

File modification timestamps (mtime)
File ordering in the archive directory table
User IDs (uid) and Group IDs (gid) of the creator

To achieve reproducible archive hashes, you must normalize metadata during creation:

# Deterministic tar creation
tar --sort=name \
    --mtime="2026-01-01 00:00:00Z" \
    --owner=0 --group=0 --numeric-owner \
    -czf release.tar.gz ./src

When comparing release artifacts or debugging integrity mismatches across platforms without installing native CLI packages, a browser-based utility like Nutilz File Hash Checker allows you to inspect MD5, SHA-1, SHA-256, and SHA-512 digests side by side using client-side WebCrypto without transmitting raw file contents over the network.

4. Memory Exhaustion on Large Files

When writing verification scripts in Node.js or Python, developers often buffer entire files into memory:

// Anti-pattern: loads the entire multi-gigabyte file into heap
const fs = require("fs");
const crypto = require("crypto");
const data = fs.readFileSync("large-dataset.iso"); // Throws ERR_FS_FILE_TOO_LARGE
const hash = crypto.createHash("sha256").update(data).digest("hex");

Once a file exceeds Node.js buffer limits (2 GB) or system memory quotas, the process crashes or silently truncates data. Always compute digests using chunked streams:

const fs = require("fs");
const crypto = require("crypto");

const hash = crypto.createHash("sha256");
fs.createReadStream("large-dataset.iso")
  .on("data", chunk => hash.update(chunk))
  .on("end", () => console.log(hash.digest("hex")));

5. Collision Vulnerabilities in MD5 and SHA-1

While modern distribution pipelines rely on SHA-256, legacy systems and vendor mirrors often still publish MD5 or SHA-1 hashes.

Both algorithms are broken against deliberate chosen-prefix collision attacks. As demonstrated by the SHAttered research team, two completely different PDF documents or binary payloads can be engineered to yield the exact same SHA-1 digest.

Never use MD5 or SHA-1 as a security boundary against tampering. Treat them strictly as accidental corruption checks for legacy downloads.

Summary Checklist

When a file hash fails to match:

Inspect the first 16 bytes for a UTF-8 BOM with xxd -l 16 <file>.
Check for CRLF line endings using file <file>.
If dealing with archives, verify whether the build pipeline enforces deterministic timestamps.
Verify checksums across both SHA-256 and legacy algorithms using client-side tools like Nutilz File Hash Checker or streaming terminal commands.

Taking two minutes to verify byte boundaries and encoding will save hours of chasing ghost security incidents.

Free vCard & iCal Generator: Turn a Form Into a File Your Phone Already Knows How to Open

Rasika Dangamuwa — Mon, 21 Sep 2026 00:01:48 +0000

Free vCard & iCal Generator: Turn a Form Into a File Your Phone Already Knows How to Open

Sharing a contact or an event usually means typing it out in a text message or email and hoping the other person copies it correctly. Two old, boring, extremely reliable file formats solve this better than any app: vCard (.vcf) for contacts and iCalendar (.ics) for events. Almost every phone, email client, and calendar app on Earth already knows how to open them — you just need a way to generate one without installing anything.

What it does

nutilz.com/vcard-ical-generator is a free two-in-one tool:

Contact Card (vCard) — fill in a name, company, title, phone numbers, email, website, and address, and it builds a standards-compliant .vcf file (RFC 6350) that any Contacts app can import with one tap.
Calendar Invite (iCal) — fill in a title, start/end time (or mark it all-day), location, description, and organizer, and it builds a standards-compliant .ics file (RFC 5545) that Google Calendar, Apple Calendar, and Outlook all understand natively.

Both formats are generated server-side and streamed straight back as a download — nothing you type is stored.

How to use it

Pick "Contact Card" or "Calendar Invite" at the top of the tool.
Fill in the fields. For a vCard, only a first or last name is required. For an iCal event, only a title and start time are required — everything else is optional.
Click generate. The file downloads immediately as .vcf or .ics.
Open the downloaded file on your phone or computer — it will offer to add it straight to Contacts or Calendar.

For events, one detail worth knowing: start and end times are captured in your browser's local time zone and converted to UTC automatically, so the event lands at the right time regardless of which calendar app or time zone opens it.

Why it's useful

Email signatures — attach a .vcf so recipients get your contact info as a real contact, not text they have to retype.
Event invites in a newsletter or plain email — most invite tools require the recipient to have an account on the same platform you used. An .ics file works with literally any calendar app, no account needed on either end.
Digital business cards — pair the generated vCard with a QR code (nutilz.com also has a QR generator) so someone can scan it at a conference and get your contact saved instantly.
One-off events — team standups, webinars, appointment reminders — where spinning up a shared calendar invite through a specific platform is overkill.

Try it free

No signup required: nutilz.com/vcard-ical-generator

Formats like vCard and iCalendar have quietly outlived a decade of "smarter" proprietary alternatives precisely because they're boring and universal — worth having a fast, free way to generate one when you need it.

Why Client-Side SVG to PNG Conversion Fails in Production: 5 Canvas Traps

Rasika Dangamuwa — Sun, 20 Sep 2026 00:31:40 +0000

Converting vector SVGs into raster PNGs in the browser seems simple. The typical HTML5 recipe looks clean: serialize an SVG string, wrap it in a Blob, create an Object URL, assign it to an Image.src, and call context.drawImage(img, 0, 0) on a <canvas> element before extracting the PNG with canvas.toBlob().

In development with trivial vectors, this works fine. But in production with real-world SVGs exported from Figma, Illustrator, or Sketch, the pipeline quickly breaks. You encounter blank exports, clipped graphics, blurry text, or outright browser security errors.

Here are five subtle rasterization traps in modern browsers and how to fix them.

1. The Missing XMLNS Namespace Failure

When an SVG element is inlined directly in an HTML5 document, browsers render it without needing an explicit XML namespace. But once you serialize it with XMLSerializer and construct a new Blob([svgText], { type: "image/svg+xml;charset=utf-8" }) for an HTMLImageElement, the browser processes it as an isolated XML document.

If the root tag lacks xmlns="http://www.w3.org/2000/svg", the parser treats the document as invalid XML. In Chromium and WebKit, image loading either fails silently or resolves with naturalWidth === 0, producing a blank 0-byte or transparent PNG.

Always guarantee the namespace before creating the blob:

function ensureSvgNamespace(svgString) {
  if (!svgString.includes("xmlns=")) {
    return svgString.replace("<svg", "<svg xmlns=\"http://www.w3.org/2000/svg\"");
  }
  return svgString;
}

2. The `viewBox` vs. Explicit Dimensions Trap

Design tools frequently export SVGs with responsive attributes like viewBox="0 0 1200 800" and width="100%" rather than static pixel dimensions.

When an HTMLImageElement loads an SVG lacking explicit width and height, the browser cannot resolve intrinsic aspect ratios against an unbounded container:

Firefox defaults intrinsic dimensions to 300px × 150px (the standard CSS replaced element fallback).
Safari can fail to render the image or clip it into a distorted square.

To fix this, parse viewBox coordinates if explicit dimensions are absent, calculate the aspect ratio, and inject computed width and height attributes onto the root <svg> tag before blob creation.

3. The Tainted Canvas Security Trap

Calling canvas.toDataURL() or canvas.toBlob() can trigger a severe DOM exception:

SecurityError: Failed to execute "toBlob" on "HTMLCanvasElement": Tainted canvases may not be exported.

Browsers strictly isolate SVG rendering in image contexts. If your SVG contains an <image> element with an external URL, an @import rule in a <style> block, or a <foreignObject> element, the canvas context is immediately marked tainted. Even if the remote server sets Access-Control-Allow-Origin: *, image-context SVG rasterization does not pass CORS credentials.

When building the client-side SVG to PNG converter on Nutilz, solving this required pre-fetching external resources with fetch(), converting them into Base64 data: URLs, and inlining them directly into the SVG markup before canvas rendering.

4. DPI Scaling and Raster Blurriness

SVGs are resolution-independent, but PNGs are rigid pixel rasters. Drawing a 400×300 SVG onto an HTML canvas with matching buffer dimensions produces blurry edges on Retina and high-DPI displays.

Users also frequently need 2x, 4x, or custom high-res exports. You must decouple logical dimensions from the physical canvas pixel buffer:

function setupCanvas(canvas, logicalWidth, logicalHeight, scale = 2) {
  canvas.width = logicalWidth * scale;
  canvas.height = logicalHeight * scale;

  const ctx = canvas.getContext("2d");
  ctx.imageSmoothingEnabled = true;
  ctx.imageSmoothingQuality = "high";
  ctx.scale(scale, scale);
  return ctx;
}

This ensures vector paths, curves, and fine borders render crisp when serialized.

5. Web Font Fallbacks in Isolated Contexts

When an SVG references web fonts (such as Inter, Roboto, or custom icon sets) declared on the parent web page, the canvas rasterizer will not inherit those @font-face definitions.

Because SVG image rendering occurs in a sandboxed execution context, external network requests for stylesheets and font files are blocked. The browser silently falls back to system fonts (Arial or Times New Roman), disrupting text kerning, line heights, and layout geometry.

The only reliable fix is embedding font data directly into the SVG using a Base64-encoded @font-face declaration within an inline <style> block before rasterizing.

Conclusion

Client-side vector conversion offers speed, eliminates backend infrastructure costs, and keeps user files private. However, treating SVG as a simple image overlooks its nature as an XML document with unique security constraints. By validating namespaces, computing dimensions, inlining remote assets, and scaling buffers, you can achieve reliable, crisp PNG exports.

If you ever need a quick, private utility to convert vector files at custom resolutions without software installs, check out Nutilz SVG to PNG.

GIF to Video: Convert Any Animated GIF to MP4 or WebM Free

Rasika Dangamuwa — Sat, 19 Sep 2026 00:02:21 +0000

GIF to Video: Convert Any Animated GIF to MP4 or WebM for Free

Animated GIFs are everywhere, but they're a genuinely bad file format for anything beyond a quick reaction meme. They're often huge compared to a real video of the same content, they can't have audio, and plenty of places — Instagram Stories, video editors, PowerPoint, most CMS upload fields — simply won't accept a .gif at all. If you've ever tried to drop a GIF into a slide deck or a short-form video app and gotten rejected, converting it to MP4 or WebM first is the fix.

What it does

GIF to Video takes an animated GIF and re-encodes it into either:

MP4 (H.264) — the safest choice for compatibility. Works in virtually every video player, editor, and social platform.
WebM (VP8) — a smaller, modern format that's ideal if you're embedding the result on a website and want faster load times.

Both outputs preserve the GIF's original animation, frame timing, and dimensions. The conversion happens entirely server-side using ffmpeg, so there's no quality loss from screen-recording a GIF playing back or any other workaround hack.

One detail worth knowing: GIFs support a form of transparency, but neither MP4 nor WebM handle transparency reliably across every player. So any transparent regions in your GIF get flattened onto a white background in the output — this matches how most video platforms behave anyway, and avoids producing a video file that looks broken in players that don't support alpha channels.

How to use it

Go to nutilz.com/gif-to-video
Drag and drop your GIF file, or click to browse and select one
Choose your output format — MP4 or WebM
Click convert and download the result

That's the whole process. No account, no watermark, no upload limits beyond a generous 25 MB cap that covers virtually any GIF you'll run into.

Why it's useful

Smaller files, same animation — video codecs like H.264 compress motion far more efficiently than GIF's per-frame palette encoding, so the converted file is often a fraction of the original size.
Upload compatibility — many platforms (Instagram, TikTok, LinkedIn, most CMS media libraries) simply reject .gif uploads but happily accept MP4.
Editing pipelines — video editors like Premiere, DaVinci Resolve, or CapCut work with video formats natively; converting your GIF first means it drops straight into a timeline instead of needing a plugin or import workaround.
Web performance — if you're embedding an animation on a website, an autoplaying, muted <video> tag with a WebM/MP4 source loads and decodes far more efficiently in the browser than an animated GIF, especially on mobile.

Anyone who works with memes, product demos, screen recordings turned into GIFs, or any kind of short looping animation runs into this conversion need eventually — it's one of those small utility tasks that's annoying to solve with a full video editor just to change a container format.

Try it free

No signup required: https://nutilz.com/gif-to-video

Free tools shouldn't require you to create an account, hand over an email address, or sit through a paywall just to do something this simple. That's the whole idea behind nutilz.com — a growing collection of genuinely useful, no-signup tools for everyday file and text tasks.

Free Online Barcode Scanner: Decode Any Barcode or QR Code from a Photo

Rasika Dangamuwa — Fri, 18 Sep 2026 00:04:32 +0000

Free Online Barcode Scanner: Decode Any Barcode or QR Code from a Photo

Ever had a barcode you needed to read but no scanner app handy — just a photo on your phone or a screenshot from a PDF? Nutilz Barcode Scanner decodes barcodes and QR codes straight from an uploaded image, right in your browser, with no app install and no signup.

What it does

Upload any image containing a barcode — a product photo, a screenshot, a scanned label — and it detects and decodes it instantly. It supports a wide range of formats:

QR codes
Retail codes: EAN-13, EAN-8, UPC-A, UPC-E
Code formats: CODE 128, CODE 39, CODE 93, Codabar, Interleaved 2 of 5
GS1 DataBar (standard and expanded)
PDF417
ISBN-10 / ISBN-13

If an image contains multiple barcodes, it detects and lists all of them in one pass.

How to use it

Go to nutilz.com/barcode-scanner
Drag and drop an image (or click to browse) — JPEG, PNG, WebP all work
Click scan
The decoded value and barcode type appear immediately, with a one-click copy button

That's it — no camera permissions needed, since it works from any image file you already have.

Why it's useful

Inventory and cataloging: quickly pull product codes from photos when building a spreadsheet, instead of retyping long numbers by hand
Checking product authenticity or specs: decode a UPC/EAN to cross-reference against a product database
Recovering data from old scans or screenshots: when the original barcode isn't physically available anymore, a saved image is enough
Developers testing barcode generation: verify that a barcode your code generated actually encodes the value you expect, without needing a phone scanner app
Library and book cataloging: decode ISBN barcodes from cover photos

Since it just reads an uploaded image, it also works well for barcodes that are hard to scan live with a shaky phone camera — a well-lit still photo often decodes more reliably than a live camera feed.

Try it free

No signup, no upload limits beyond a reasonable file size cap: https://nutilz.com/barcode-scanner

Free, fast, single-purpose tools like this are exactly what the web needs more of — no account walls, no ads blocking the result, just the answer you came for.

Silence Remover: Automatically Cut Dead Air From Audio or Video, Free

Rasika Dangamuwa — Thu, 17 Sep 2026 00:01:53 +0000

Dead air is the thing that makes a podcast, voiceover, or screen recording feel unpolished — the long pause while you gather your thoughts, the silence after a mistake before you re-record the line, the empty stretch at the start of a take before you actually start talking. Editing all of that out by hand, clip by clip, is one of the most tedious parts of post-production. Silence Remover automates it: upload a file, and it cuts every silent gap out for you, for free, with no software to install.

What it does

Silence Remover scans an audio or video file for stretches that fall below a volume threshold, removes them, and stitches what's left back into one continuous file. It supports common audio formats (MP3, WAV, OGG, FLAC, AAC, M4A, WMA, OPUS) and video formats (MP4, MOV, WebM, MKV, AVI, M4V) up to 100 MB.

For video specifically, both the picture and the audio track are trimmed at the exact same points, so lips stay in sync with the voice — it's not just muting the audio, it's actually removing the dead time from the timeline.

Two things make it more than a blunt on/off cut:

Silence threshold — how quiet a section has to be before it counts as "silence." Turn it down if you only want to cut near-total silence; turn it up if you also want quieter background noise or room tone trimmed.
Minimum gap length — how long a quiet stretch has to last before it gets cut. This stops the tool from chopping up natural micro-pauses between words and only targets genuinely dead air.

A small buffer is kept on either side of every cut, so a word that starts or ends right at the edge of a silent gap doesn't get clipped mid-syllable.

How to use it

Go to nutilz.com/silence-remover and drop in an audio or video file (or click to browse).
Adjust the threshold and minimum gap sliders if the defaults don't suit your recording — noisier rooms usually want a higher threshold.
Click "Remove Silence" and let it process — it runs entirely on the server, so there's nothing to install.
Preview the result in the browser, then download it.

Why it's useful

This is a genuine time-saver for anyone who records regularly and doesn't want to pay for (or learn) a full editing suite just to tighten up dead air: podcasters cleaning up raw recordings before publishing, YouTubers and educators trimming screen recordings and tutorials, and anyone doing voiceover work who re-records lines and doesn't want to manually hunt down every gap afterward. It won't replace a real edit for pacing or content, but it removes the single most repetitive part of that process automatically.

Try it free

No signup, no upload limits beyond the file size cap, nothing to install: https://nutilz.com/silence-remover

Free tools that just do the boring, repetitive part of a job well are worth more than another account you have to create — that's the whole idea behind nutilz.com.

PDF Page Rotator & Reorder: Fix Sideways Scans and Reshuffle Pages, Free

Rasika Dangamuwa — Wed, 16 Sep 2026 00:02:01 +0000

PDF Page Rotator & Reorder: Fix Sideways Scans and Reshuffle Pages, Free

If you've ever scanned a document and gotten a few pages upside down, or merged two PDFs and ended up with the pages in the wrong order, you know how annoying it is to fix without proper software. Most people either live with the mess or install a full PDF editor just to rotate a handful of pages. There's a faster way.

PDF Page Rotator & Reorder is a free browser tool that does exactly what the name says: rotate any page in a PDF and drag pages into a new order, then download a single corrected file. No account, no install, no watermark.

What it does

Per-page rotation — click the rotate button on any page thumbnail to turn it 90° at a time. Each page rotates independently, so you can fix one sideways scan without touching the rest of the document.
Drag-and-drop reordering — drag a page thumbnail to a new spot in the sequence, or use the arrow buttons if you'd rather not drag. Rotation and reordering are fully independent, so you can do either, both, or neither on any given page.
Live thumbnail preview — every page renders as an image as soon as you upload, so you can see exactly what you're rearranging instead of guessing from page numbers.
Lossless output — pages are copied directly from the original PDF's page data. Text stays selectable, images stay full resolution, nothing gets rasterized or recompressed in the process.

How to use it

Open nutilz.com/pdf-rotate-reorder and drop in your PDF (up to 50MB, 200 pages).
Wait for the thumbnails to load — each page shows up as its own tile.
Click ↻ on any page to rotate it 90° clockwise (click again for 180°, 270°, back to 0°).
Drag pages into the order you want, or use the ← / → buttons on each tile.
Download the corrected PDF. It comes out as a single file with your new page order and rotations baked in.

Why it's useful

This tool exists for the specific moment when a document is almost right. A few common cases:

A multi-page scan where the feeder grabbed one sheet sideways, so every other page reads fine except that one.
Two PDFs merged in the wrong sequence — say, an appendix that landed before the main report.
A signed contract scanned upside-down because it went through the scanner face-down.
A batch of receipts or forms scanned out of order that need to match a specific filing sequence before you archive them.

None of these need a full PDF editor. They need rotation and reordering, which is exactly what this tool is scoped to — nothing more to learn, nothing else in the UI to get in the way.

Try it free

No signup required: https://nutilz.com/pdf-rotate-reorder

Free tools that solve one specific, annoying problem well tend to be more useful day-to-day than bloated suites that solve everything poorly. This is one of those — give it a try next time a scan comes out crooked.

The 00:00 UTC Thundering Herd: Why Cron Schedule Collisions Crash Production Databases

Rasika Dangamuwa — Tue, 15 Sep 2026 00:31:38 +0000

Every DevOps and backend team has experienced the ghost in the machine: at exactly 00:00:00 UTC, database connections spike, API latencies shoot through the ceiling, and alert channels light up with 504 Gateway Timeouts. Ten minutes later, without human intervention, everything returns to normal.

The culprit is almost always scheduled task collision—the midnight thundering herd.

When engineers add background tasks, "run once a day at midnight" is the default instinct. Over months and years, different microservices and scripts pile up on the same schedule. At 00:00, your database is simultaneously hit by database vacuuming, stale session purges, billing reconciliation, Elasticsearch re-indexing, and automated report generation.

PostgreSQL maxes out its connection pool, IOPS throttles on AWS EBS volumes, and incoming user web traffic stalls waiting for database locks.

Beyond simple midnight collisions, several subtle cron syntax behaviors and architectural oversights cause production outages. Here is how scheduled jobs break in production and how to prevent cascading failures.

1. The Infamous POSIX DOM vs. DOW Trap

The single most dangerous edge case in standard Unix/POSIX cron is how Day-of-Month (DOM) and Day-of-Week (DOW) interact.

In almost every programming language, filtering criteria are combined with logical AND. You might assume that setting:

0 3 1-7 * 1

means "run at 03:00 on the first Monday of the month" (if the day of month is between 1 and 7 AND the day of the week is Monday).

In POSIX and Vixie cron, this assumption is flatly wrong. Under standard cron specifications, if both the day-of-month and day-of-week fields are specified (meaning neither is an asterisk *), the two conditions are combined with OR, not AND.

Instead of running only when Monday falls between the 1st and the 7th, this expression triggers:

Every single day from the 1st to the 7th of the month, PLUS
Every Monday throughout the entire month.

A monthly billing job intended to run once per month will fire 11 or 12 times. If the task is not strictly idempotent, users get duplicate charges or multiple billing notifications.

To achieve true "first Monday of the month" execution in standard cron, you must evaluate the day inside the command itself:

0 3 1-7 * * [ $(date +\%u) -eq 1 ] && /usr/local/bin/monthly-sync.sh

2. The 15-Minute Harmonic Resonance

Another common collision pattern is harmonic scheduling across independent microservices.

Engineers routinely schedule routine syncs at */15 * * * * or */30 * * * *. When five separate services use identical intervals, they all wake up at :00, :15, :30, and :45. Even if their individual resource footprints are modest, their combined resource spike saturates CPU cores and network interfaces simultaneously.

The fix is simple: stagger your schedules. Rather than defaulting to minute 0 or round 15-minute marks, assign arbitrary offset minutes:

# Service A: runs every 15 mins at :03, :18, :33, :48
3,18,33,48 * * * * /app/sync-inventory

# Service B: runs every 15 mins at :07, :22, :37, :52
7,22,37,52 * * * * /app/refresh-rates

Plotting your schedules across a multi-day timeline using a browser tool like nutilz.com/cron-timeline makes it easy to visualize firing heatmaps and spot these overlapping peaks across your scheduled fleet before deploying them.

3. Missing Dates and Daylight Saving Time Skips

Two temporal traps reliably cause cron jobs to fail to execute:

Short Months: A cron expression like 0 4 31 * * will never execute in February, April, June, September, or November. If an invoice script relies on the 31st, it silently skips 5 months out of the year.
DST Spring Forward: In timezones observing Daylight Saving Time, clocks skip from 02:00 to 03:00 in spring. A job scheduled for 30 2 * * * will either be skipped entirely or behave unpredictably depending on whether your cron daemon runs in local time or UTC. Always configure production servers and cron engines in UTC (Etc/UTC).

4. Production Hardening: Locks and Jitter

To prevent scheduled tasks from degrading production stability:

Implement Distributed Locking: Ensure tasks cannot run concurrently if an earlier run takes longer than expected. Use Redis keys with timeouts (SET key token NX EX 3600) or PostgreSQL advisory locks (SELECT pg_try_advisory_lock(12345)).
Add Execution Jitter: Add random delay before executing batch requests to external APIs:

sleep $((RANDOM \% 180)) && /usr/local/bin/sync-job

Audit Timelines Visually: Never deploy complex cron expressions to production without inspecting their actual future execution timestamps. Visual timeline tools like the Nutilz Cron Timeline Visualizer allow you to inspect multi-day execution distribution and verify that your jobs never pile up at the same minute.

Audio Trimmer: Cut Any Audio Clip Free, Right in Your Browser

Rasika Dangamuwa — Mon, 14 Sep 2026 00:01:23 +0000

Audio Trimmer: Cut Any Audio Clip Free, Right in Your Browser

Got a podcast recording with ten seconds of dead air at the start, a voice memo you only need the middle third of, or a song you want to clip down to a 30-second sample? You don't need Audacity, a DAW, or an account anywhere — you need to drag two handles and hit trim.

What it does

Audio Trimmer lets you cut a precise section out of an audio file directly in your browser. Drop in an MP3, WAV, OGG, FLAC, AAC, M4A, WMA, or Opus file up to 100MB, and you get a waveform-style player with two draggable handles for the start and end points. Drag them to where you want the clip to begin and end, preview it, and export just that section — nothing else touches the file.

Clips can run up to 30 minutes, which covers almost anything short of a full album or a long-form podcast episode. The output keeps the original quality; there's no re-encoding pass that mushes your audio into a lower bitrate to save processing time.

How to use it

Go to nutilz.com/audio-trimmer and drop your audio file onto the page (or click to browse).
Once it loads, you'll see the total duration and two handles on the timeline — one for the start, one for the end.
Drag each handle to the point you want to keep. The current start/end times update live as you move them.
Hit play to preview just the trimmed section before you commit.
Click trim/export, and the cut file downloads straight to your device.

That's the whole workflow. No upload-then-wait-in-a-queue step, no email confirmation, no watermark stamped on your output.

Why it's useful

Most audio editing is overkill for a trim. If all you need is to remove silence from the front of a recording, isolate a quote from an interview, grab a ringtone-length clip, or shorten a voice note before sending it, opening a full DAW is a lot of friction for a ten-second job. A browser-based trimmer that does exactly one thing well is faster for that case every time.

It's also handy alongside nutilz's other audio tools — trim a clip here, then merge it with another using Audio Merge if you're stitching pieces together, or run it through Silence Remover first if the raw recording has dead air scattered throughout rather than just at the edges.

Try it free

No signup, no install, no watermark: https://nutilz.com/audio-trimmer

Free tools that just do the one job you actually came for, without asking for your email first, are worth keeping around.

How to Merge Multiple Audio Clips Into One File (Free, No Software)

Rasika Dangamuwa — Sun, 13 Sep 2026 00:02:19 +0000

Anyone who's tried to combine a handful of voice memos, podcast segments, or song clips into one file knows the usual options aren't great: install a desktop editor you'll use once, wrestle with a mobile app that adds a watermark, or hunt down an ffmpeg command and hope you remember the syntax. Most of the time you just want the files stitched together in order, as one clean track, without installing anything.

The core problem: mismatched formats

The annoying part isn't joining audio — it's that the clips you want to combine are rarely in the same format. A voice memo from a phone might be an M4A at 44.1kHz mono, a podcast segment might be a stereo WAV at 48kHz, and a background track might be an MP3 at some other rate entirely. Naively concatenating files with mismatched sample rates or channel layouts produces glitches, speed changes, or outright silence in some players — the raw bytes don't line up.

The fix is to decode everything back to raw PCM audio, resample and re-channel it to a single common format, and then re-encode the whole thing as one file. That's more than a simple "paste these files together" operation, which is why it usually needs actual audio tooling rather than a file-concatenation trick.

A free tool that does this in the browser

Audio Merger handles exactly this. You drop in your clips — MP3, WAV, OGG, FLAC, AAC, M4A, WMA, or Opus, and you can mix formats in the same batch — reorder them with simple up/down controls, and it normalizes every clip to a matching sample rate and channel layout server-side before joining them into a single MP3.

What it does:

Accepts up to 8 clips per job, each up to 40 MB, 150 MB combined
Automatically normalizes differing sample rates and channel layouts (mono/stereo) so mixed-format clips merge cleanly instead of glitching
Lets you reorder clips before merging, so you control the final sequence
Always outputs a single standard MP3, playable anywhere
Runs entirely server-side — no plugins, no desktop software, and files are deleted immediately after processing rather than stored

How to use it:

Drag and drop two or more audio files onto the upload area (or click to browse).
Use the up/down arrows to put the clips in the order you want them to play.
Click "Merge Clips" and wait for the server to process them.
Preview the result in the built-in player, then download the merged MP3.

Where this is actually useful

A few real situations where this comes up: stitching together several short voice memos into one recording instead of sending someone five separate files, assembling podcast segments (intro, interview, outro) recorded at different times into a single episode file, combining short song clips into a mixtape-style track, or joining audio notes recorded across multiple takes into one continuous file for transcription.

It's a narrow tool by design — it merges, it doesn't trim, mix volumes, or add effects. If you need to cut a clip down first, a companion Audio Trimmer handles that, and an Audio Format Converter is there if you just need to change formats without merging anything.

Try it here, free, no signup: https://nutilz.com/audio-merge

Small, single-purpose tools like this are underrated — you don't always need a full DAW to solve a five-minute problem, you just need the one operation you're actually trying to do, done correctly.

Subtitle Burner: Free Tool to Hardcode SRT/VTT Captions Into Any Video

Rasika Dangamuwa — Sat, 12 Sep 2026 00:01:54 +0000

Subtitle Burner: Hardcode SRT/VTT Captions Into Any Video for Free

If you've ever needed to add captions to a video for social media, a tutorial, or accessibility, you know the usual options are a pain: video editors with steep learning curves, desktop software that eats gigabytes of disk space, or paid SaaS tools gated behind a subscription. Subtitle Burner skips all of that — it's a free, browser-based tool that permanently burns SRT or VTT subtitles into your video file.

What it does

Subtitle Burner takes two inputs — a video file (MP4, MOV, WebM, MKV, or AVI, up to 100 MB) and a subtitle file (.srt or .vtt, up to 2 MB) — and renders the captions directly into the video frames. Unlike subtitle tracks that a player can toggle on or off, "burned-in" captions are baked into the picture itself, so they show up everywhere: Instagram, TikTok, WhatsApp shares, embedded players, anywhere that doesn't respect separate subtitle tracks.

You can pick from three font sizes (small, medium, large) to match the video's resolution and viewing context, then download the finished file once processing completes.

How to use it

Go to nutilz.com/subtitle-burner
Drop in your video file, or click to browse
Drop in your .srt or .vtt subtitle file
Choose a font size
Click burn, then download the result once it's ready

No account, no upload limits beyond the file size caps, and no watermark on the output.

Why it's useful

Burned-in subtitles solve a real distribution problem: most short-form video platforms autoplay muted, and viewers scroll past anything they have to tap to understand. Captions baked into the frame get watched. They're also useful for:

Repurposing long-form content (podcasts, webinars, lectures) into clip-friendly captioned segments
Making tutorial videos accessible without relying on a platform's auto-caption feature
Sharing videos in contexts where the player won't render a separate subtitle track (raw file shares, some embeds, older devices)
Language learners who want captions permanently visible regardless of player settings

If you already have a transcript or auto-generated captions in SRT/VTT format — from YouTube, Whisper, or a captioning service — this tool is the fastest way to turn them into a shareable, caption-baked video without installing anything.

Try it free

No signup required: https://nutilz.com/subtitle-burner

Free tools shouldn't come with friction. Subtitle Burner runs the conversion, hands you the file, and gets out of your way.

DEV Community: Rasika Dangamuwa

The SPF 10-Lookup Trap: Why Transactional Emails Land in Spam

The RFC 7208 10-Lookup Limit

Which Mechanisms Count?

The Void DNS Lookup Trap

Anti-Pattern: Multiple SPF Records

How to Fix It

1. Subdomain Delegation (Recommended)

2. SPF Flattening

Summary Checklist

Why File Hashes Fail to Match: 5 Checksum Traps Every Developer Hits

1. CRLF vs. LF Line-Ending Normalization

2. The Invisible UTF-8 Byte Order Mark (BOM)

3. Archive Non-Determinism in Tar and Zip Files

4. Memory Exhaustion on Large Files

5. Collision Vulnerabilities in MD5 and SHA-1

Summary Checklist

Free vCard & iCal Generator: Turn a Form Into a File Your Phone Already Knows How to Open

Free vCard & iCal Generator: Turn a Form Into a File Your Phone Already Knows How to Open

What it does

How to use it

Why it's useful

Try it free

Why Client-Side SVG to PNG Conversion Fails in Production: 5 Canvas Traps

1. The Missing XMLNS Namespace Failure

2. The viewBox vs. Explicit Dimensions Trap

3. The Tainted Canvas Security Trap

4. DPI Scaling and Raster Blurriness

5. Web Font Fallbacks in Isolated Contexts

Conclusion

GIF to Video: Convert Any Animated GIF to MP4 or WebM Free

GIF to Video: Convert Any Animated GIF to MP4 or WebM for Free

What it does

How to use it

Why it's useful

Try it free

Free Online Barcode Scanner: Decode Any Barcode or QR Code from a Photo

Free Online Barcode Scanner: Decode Any Barcode or QR Code from a Photo

What it does

How to use it

Why it's useful

Try it free

Silence Remover: Automatically Cut Dead Air From Audio or Video, Free

What it does

How to use it

Why it's useful

Try it free

PDF Page Rotator & Reorder: Fix Sideways Scans and Reshuffle Pages, Free

PDF Page Rotator & Reorder: Fix Sideways Scans and Reshuffle Pages, Free

What it does

How to use it

Why it's useful

Try it free

The 00:00 UTC Thundering Herd: Why Cron Schedule Collisions Crash Production Databases

1. The Infamous POSIX DOM vs. DOW Trap

2. The 15-Minute Harmonic Resonance

3. Missing Dates and Daylight Saving Time Skips

4. Production Hardening: Locks and Jitter

Audio Trimmer: Cut Any Audio Clip Free, Right in Your Browser

Audio Trimmer: Cut Any Audio Clip Free, Right in Your Browser

What it does

How to use it

Why it's useful

Try it free

How to Merge Multiple Audio Clips Into One File (Free, No Software)

The core problem: mismatched formats

A free tool that does this in the browser

Where this is actually useful

Subtitle Burner: Free Tool to Hardcode SRT/VTT Captions Into Any Video

Subtitle Burner: Hardcode SRT/VTT Captions Into Any Video for Free

What it does

How to use it

Why it's useful

Try it free

2. The `viewBox` vs. Explicit Dimensions Trap