DNS lookup — and who really runs this domain
Every public record (A, AAAA, MX, NS, TXT, CAA, SOA, DS) as Google and Cloudflare see it, with TTLs — and what they add up to: the web host, the DNS provider, the mail provider and the services the domain uses.
What it checks
- Email authentication (SPF, DMARC)Without them anybody can send mail in your domain's name, and your own mail lands in spam.
- Domain registrationWhen the registration lapses, the site and every mailbox on the domain stop on the same day — and nothing on the site warns about it beforehand.
- DNS recordsThe records decide where the site, the mail and every service on the domain are served from.
- Name server redundancyWith one name server, one outage takes the whole domain offline — site and mail together.
- DNSSECSigned DNS answers stop an attacker who poisons a resolver's cache from sending your visitors to another server.
- CAA recordCAA names which certificate authorities may issue certificates for the domain — any other must refuse.
- Seen the same everywhereGoogle's and Cloudflare's resolvers should give the same answers. A difference is a change still spreading, or a provider answering by location.
Questions
How do you know who hosts a site behind Cloudflare?
Often we cannot, and then we say so. When the domain's own public names — mail, ftp, cpanel — point at a server outside the CDN, that is shown as likely, with the names it rests on.
Where does the list of services come from?
From the domain's own public records: the verification tokens services ask a domain owner to add, and the senders its SPF record allows. Nothing is guessed.
Is this a scan of my site?
No. It reads public DNS, the same answers every resolver in the world gets. No zone transfer is attempted and no hidden name is guessed.
We only read what a public visitor could. Nothing is submitted to your site and no vulnerability is exploited — findings are what your site shows, not what we tried.