Look up a domain
What the report covers
Registration
RDAP, the structured successor to WHOIS, returns the sponsoring registrar, the dates and the transfer locks.
DNS
Every common record type is queried directly against public resolvers, including the mail authentication records.
Infrastructure
Each IP is mapped to the network that announces it, plus reverse DNS and any CDN sitting in front.
Application
One ordinary page request reveals the CMS, framework, server software and the security headers in use.
How CMS and framework detection works
There is no record anywhere that names the software a site runs on, so detection is a matter of reading the evidence the application leaves in its own response. Three sources cover most of it. Asset paths in the HTML are the clearest: /wp-content/ means WordPress, _next/static means Next.js, cdn.shopify.com means Shopify. Cookies are next — laravel_session is Laravel, PHPSESSID is plain PHP, JSESSIONID is Java, connect.sid is Express. Finally the response headers and the generator meta tag frequently name the platform outright, sometimes with a version number.
Every signal found is listed rather than collapsed into a single verdict, because real sites stack. A WordPress install behind Cloudflare running Elementor and jQuery is four true answers, not one, and the combination is usually more useful than any single label.
Why the layers matter separately
Registration, DNS, hosting and mail are four services that can sit at four companies. A domain registered at Porkbun can delegate DNS to Cloudflare, serve its site from a droplet at DigitalOcean and route mail through Google with Proofpoint filtering in front. That is an entirely normal setup, and it means there is no single dashboard where "the domain" lives.
The practical consequence shows up whenever something needs changing. A DNS record added at the registrar when authority has been delegated elsewhere will save without error, display correctly in that panel, and resolve nowhere at all. Confirming which nameservers are actually authoritative before editing anything is the step that prevents an afternoon of debugging a record that was never live.
Reading the results
| Finding | What it means | What to do |
|---|---|---|
| Expiry inside 30 days | Renewal risk. Expiry takes down mail as well as the website. | Confirm auto-renew and that the card on file is valid. |
| No transfer lock | The domain can be moved with less friction than it should take. | Enable the registrar lock — it is free. |
| DNSSEC not enabled | DNS answers are not cryptographically signed. | Optional for most, worth enabling on domains that matter. |
| Nameservers from two providers | Mixed delegation, normally an unfinished migration. | Consolidate, then re-verify every record. |
| Host reported as a CDN | Proxied. The origin is hidden by design. | Treat any origin hint as a lead, not an answer. |
| SPF above 10 lookups | Exceeds the DNS lookup limit — receivers may return permerror. | Flatten or trim includes. The lookup counter breaks it down. |
| DMARC p=none | Monitoring only. Nothing is enforced against spoofing. | Fix alignment first, then move to quarantine and reject. |
| No MX records | The domain cannot receive mail at all. | Expected on a send-only domain, a problem anywhere else. |
| No HSTS header | Browsers can still be talked into a plaintext first request. | Add HSTS once HTTPS is confirmed working everywhere. |
Where this fits
On a cold email fleet this is the first pass. Domains get bought across several registrars over a couple of years, DNS ends up in places nobody remembers, and half the authentication records were added to a panel that stopped being authoritative long ago. Mapping every layer before touching anything is what turns guesswork into a checklist.
Once the picture is clear, the focused tools go deeper: host checker for registrar and hosting, NS checker for delegation, MX checker for mail routing, then SPF, DKIM and DMARC.
Questions
Is this WHOIS or RDAP?
RDAP, which is the structured replacement for WHOIS that registries are now required to publish. It returns the same registration facts as classic WHOIS but as machine-readable JSON, so the dates and status codes are exact rather than scraped from free text. Domains on TLDs that publish no RDAP service will show an empty registration section while DNS and hosting still resolve normally.
Why are some TXT records unfamiliar?
Most long random-looking TXT records are domain ownership proofs left behind by services like Google, Microsoft, Facebook or Atlassian. They are harmless, but they accumulate. Any record that verifies a service you no longer use can be removed — the report lists them separately so they are easy to audit.
Does it detect every technology?
No, and nothing does. Server-rendered sites with no framework fingerprints, aggressive asset bundling, or a CDN that strips headers will all reduce what is visible. An empty technology section means nothing was detectable from the response, not that the site is custom-built — though a custom build is one common reason for it.
How current is the data?
DNS answers are cached briefly to keep repeat lookups fast, so a change made in the last few minutes may not appear immediately. Registration data comes straight from the registry. The page request is live every time.
Can I check a lot of domains?
Five per run here, because each one runs several dozen queries. For auditing a fleet of hundreds, the same data sources become a scripted job — get in touch if that is the situation.
More in this category
What to run next
The checks people most often reach for alongside this one.
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.