DNS lookup
Everything DNS says about a domain: traced from the root servers down, every record type asked of the domain's own nameservers, each nameserver checked, then every hostname and policy record it points at followed, with SPF, DMARC, DKIM and DNSSEC checked along the way.
What it checks
- Trace
- Starts at a root server and follows each referral (root → TLD → the domain's nameservers), the way a resolver does, and through every CNAME.
- Records
- Some 30 record types asked of an authoritative server directly, so you see live values, not what a cache remembers.
- Nameservers
- Every address of every nameserver, listed at the parent or in the zone: does it answer, is it authoritative, do the SOA serials agree, does the glue match.
- Related names
- DMARC, MTA-STS, TLS-RPT, BIMI, 36 common DKIM selectors, 30-odd SRV services, DANE for each mail server, www and wildcards.
- Hosts
- Every nameserver, mail server, alias and service target resolved to its addresses, with reverse DNS and whether it points back.
- The SPF policy expanded through every include, counting against the limit of 10 lookups; DMARC explained.
- DNSSEC
- The parent's DS records checked against the zone's keys (digests recomputed), signature expiry, and whether validating resolvers accept it.
- Resolvers
- What Cloudflare, Google, Quad9 and OpenDNS answer right now, to spot changes that haven't spread yet.