DNS and email records
A, AAAA, NS, MX, CAA, TXT and SOA records, plus DNSSEC, SPF, DKIM and DMARC. Free, no signup, 5 checks a day.
This page focuses on raw DNS data and mail authentication. Use the full report when you also want certificate, hosting, headers, history and reputation.
How to read these records
These notes cover the main DNS and mail-authentication records, what they are for and what a missing record usually means.
DNSSEC
Signs the zone so a resolver can prove the answer it received is the answer the zone published. Unsigned is the default across most of the internet, and it is what lets a poisoned cache go unnoticed.
CAA
Names the certificate authorities allowed to issue for the domain. Without one, any public CA may issue a certificate for your name and the first you hear of it is the certificate transparency log.
SPF
Lists the servers allowed to send mail as the domain. A receiving server checks it before deciding whether the envelope sender is plausible.
DKIM
Signs outgoing mail with a key published in DNS. The selector is chosen by the sender and listed nowhere a checker can enumerate, so not finding one does not prove the domain signs nothing.
DMARC
Tells receivers what to do when SPF and DKIM disagree with the From address, and where to send the reports. Without it, a failed check is advisory and nothing acts on it.