About

How the answers are obtained

Queries go over DNS over HTTPS, to five public resolvers: Cloudflare, Google, AdGuard, AliDNS and DNS.SB. The server's own resolver is never used — it carries blocklists, and a diagnostic tool querying a filtering resolver would return false results on exactly the domains submitted to understand a problem.

The propagation tool additionally queries the domain's authoritative servers, directly and over the binary protocol. That is the only way to see that a secondary has not transferred the zone — a failure that, unlike a caching gap, does not clear by itself.

Answers are kept for five minutes. A result marked "cached" may therefore be a few minutes old.

What the tool cannot do

DKIM cannot be checked automatically. Nothing in DNS allows a domain's selectors to be enumerated: they are read from the DKIM-Signature header of a message actually sent. Probing common selectors therefore never proves an absence.

Port probes target only the servers named by the MX of the domain requested, and only the seven mail ports. A per-IP cap applies: this server also runs a mail service, and its address has no business appearing in the world's scan logs.

The score is a reading, not a verdict. It aggregates four weighted categories and is not comparable to another tool's, which does not look at the same things.

All tools

• DNS lookup — Every record type, with its TTL and the DNSSEC validation state.
• Propagation — The same question asked of five public resolvers and of your authoritative servers.
• Reverse lookup — From an IP address to its name, and a check that the round trip agrees.
• Domain record — Availability, registrar, dates and locks, read from the registry RDAP.
• Punycode / IDN — Conversion both ways, with detection of look-alike characters.
• Mail server — MX, reverse DNS, FCrDNS, open ports, SMTP banner and the certificate served.
• SPF — Analysis and generation, with the real count of DNS lookups triggered.
• DKIM — Public key readout, length, algorithm and detection of revoked keys.
• DMARC — Policy readout, guided generation and validation of report recipients.
• MTA-STS — Policy, TXT record and a check that the policy is actually being served.
• Email headers — Path taken, delays, authentication results. Analysed in your browser.
• DNSSEC — DS to DNSKEY chain, algorithms in use and confirmation that validation holds.
• CAA — Which authorities may issue a certificate for this domain, and generation.
• SEO and AI visibility — Tags, robots.txt, sitemap, security headers and the policy towards AI crawlers.