Type a domain and read the whole picture in one pass: who owns it, where its mail goes, whether its email is authenticated, and where it is hosted. The DNS records come from the public resolver you pick, and the registration data comes from the registry’s RDAP service. Both run in your browser.
What each section shows
| Section | What it shows |
|---|---|
| Registration | What the registry publishes through RDAP, the structured successor to WHOIS: registrar, status, key dates, and the name servers on record |
| MX | The mail servers that accept email for the domain, with their priority: lower numbers are tried first |
| SPF | The TXT record that lists the hosts allowed to send mail for the domain |
| DMARC | The TXT record at _dmarc that tells receivers what to do when SPF and DKIM do not line up |
| DKIM | Public keys published at common selector names. Selectors are chosen by the sender, so this is a check of the usual ones, not a complete list |
| TXT | Every TXT value published at the domain, not only the mail ones. Site and service verification tokens are normal here and sit in public DNS |
| A and AAAA | The IPv4 and IPv6 addresses the name points to, including any CNAME chain |
| Hosts, addresses and ownership | Host names seen by public passive data, and the addresses behind the domain, each with its AS number, network name, netblock, country and reverse DNS |
| NS | The name servers the domain is delegated to |
| SOA | The domain’s authority record: primary name server, contact mailbox and caching timers |
How to read it
The flags at the top are a quick read: green means the record was found, grey means it was not. A missing SPF or DMARC record is common on domains that only receive mail, but it usually matters on a domain that sends it.
The TTL is the number of seconds a resolver may keep an answer cached. If you just changed a record, expect to see the old value until the previous TTL has run out. The registration section is what the registry records right now, and the DNS sections are what one public resolver returns right now.
The DKIM check is honest about its limits: it probes a list of common selectors such as default, google, selector1 and selector2. A sender can publish DKIM under any name it likes, so an empty DKIM section means none of the usual names answered, not that the domain sends unsigned mail.
The host list is the part to read slowly. Host names come from public passive data, so they show only what other people’s scans and certificates have already revealed: a service that has never been seen publicly will not appear. Each address is then looked up for its owner. The AS number, network name, netblock and country come from Team Cymru’s public mapping service, asked through the resolver you pick, and the reverse DNS name comes from that same resolver. A host pointing at a provider the company does not use is worth a question.
What this tool does not do
- It shows one resolver’s current view plus the registry’s record. It cannot prove that a change has reached every resolver, and an older cached answer is normal until the TTL expires.
- It reads records. It does not test mail deliverability, reputation or blocklists, and it is not a security audit or a complete email diagnosis.
- Registration details are often redacted by the registry for privacy, so the registrant may be blank by design. Not every registry or domain is in RDAP.
- It does not scan ports or read service banners. That information is not in DNS, and a browser cannot open a port. The service and banner columns on other reconnaissance sites come from their own scanning systems, not from records, so they are not available here.
- It finds hosts from public passive data only. It does not guess or brute force names, so a host that has never appeared in public data stays invisible to this tool.
- Your DNS queries go straight from your browser to the resolver you pick, and the registration lookup goes to the registry’s RDAP service. Those services see the domain you enter and keep their own logs. Nothing is sent to this site and nothing is stored, so do not type internal or private names. Names must be public and in ASCII; for an internationalized domain, use the punycode form. The host list comes from Hackertarget’s passive dataset, which also sees the domain you enter, and it is rate limited. Use this tool on a domain you own or are responsible for, or on one you have permission to look at.