zerobounce.ai
Domains and networks

Domain analyzer and DNS lookup

See every third-party service a domain uses, read from its public DNS, with the record that revealed each one. Also shows the registrar, the domain’s age, expiry date, locks and DNSSEC from the registry.

By using these tools you accept the Terms and the Privacy page.

A domain name. Addresses and URLs work too; only the domain is used.

How the domain analyzer works

The domain analyzer reads a domain’s public DNS and its registry record, then names the third-party services those records point to: mail hosts, sending platforms, support desks, DNS hosts, CDNs and certificate authorities. It helps admins audit their own zone, security teams size up a vendor, and anyone who wants to know what a domain runs on before they trust it.

How services are matched

Each service has a fingerprint. In a TXT record it’s the start of a verification token, such as google-site-verification=. For SPF includes, MX hosts, name servers, subdomain CNAMEs and DMARC or TLS-RPT report addresses, it’s a domain suffix that has to match on a label boundary. Both rules keep a short service name that happens to sit inside some unrelated token from counting as a detection.

Two more signals come from IP addresses and CAA records. When the domain’s A or AAAA record falls in Cloudflare’s published IP ranges, the site is listed as behind the Cloudflare proxy. CAA issue values are mapped to the certificate authority behind them. Once the services are known, the analyzer looks for DKIM keys at the selectors the detected providers use and fills up with common ones such as default and selector1, up to four selectors in all.

How to read the posture list

The Posture section grades the basics, with problems sorted to the top.

  • SPF: two or more v=spf1 records, or a record ending in +all, is a problem. A neutral ?all, or no all mechanism, is a warning; ~all and -all pass.
  • DMARC: p=quarantine and p=reject pass. p=none shows as monitoring only, because spoofed mail is still delivered.
  • DKIM: a key at any selector checked passes. No key there isn’t proof DKIM is missing, since senders often use their own selector names.
  • MTA-STS and TLS-RPT: checked for presence only, and only when the domain has a mail server.
  • DNSSEC: it passes when the resolver marks answers as authenticated. A DS record at the registry with answers that don’t validate is a warning; check that the DS still matches the zone’s current key.
  • Registration: hold, redemption and pending-delete statuses, or an expired registration, are problems. A missing transfer lock, or an expiry date 30 days away or less, is a warning.

Where the registration data comes from

The analyzer finds the registry’s RDAP server through IANA’s bootstrap file, which it keeps for a day. If the registry has no record for the exact name, it tries the name one level up. Some registries’ RDAP servers rate-limit Cloudflare’s network, so when RDAP fails or isn’t offered, the analyzer tries WHOIS for the same facts. The registry lookup starts first, with a connection of its own, and the whole check stops after 12 seconds: anything still missing then is shown as “couldn’t check”, and that result isn’t cached. Dates are shown in UTC, so every visitor sees the registry’s calendar day.

Reading the headline, and what to check next

The headline counts the services and categories found, and its tone follows the most serious posture item. A name the registry knows but DNS answers with NXDOMAIN is reported as registered but not resolving; a missing name under a registered domain is reported as not existing, with the registered domain to check instead. A domain with a null MX shows “Accepts no email”; publish v=spf1 -all as well, so nobody can send as it either. A leading www. is dropped from what you enter, because it usually stands for the organization’s domain.

For the full mail setup, run the deliverability score. To look for DKIM keys at other selectors, use the DKIM checker. To read the raw text from every WHOIS server, try the WHOIS lookup.

Updated · Maintained by Liviu Tanase

Questions

What does the analyzer look at?

Public DNS only: TXT verification tokens, MX hosts, name servers, SPF includes, DMARC and TLS-RPT report addresses, CAA records, HTTPS records and the CNAMEs of common subdomains (www, mail, autodiscover, status, help, docs, shop, blog). Registration details come from the registry’s RDAP server, found through IANA’s directory.

How reliable are the detections?

Each one shows the record it rests on. Verification tokens and SPF includes are strong signals that someone set the service up, but they can outlive a cancelled account: a leftover google-site-verification token proves the domain was verified once, not that it is used today. Services that leave no DNS trace can’t be seen.

Why does a lookup say it couldn’t be checked?

The DNS resolver or the registry didn’t answer in time, or answered with an error. The whole check stops after 12 seconds. Anything unanswered is reported as unknown rather than as a missing record, and the result isn’t cached, so Check again retries straight away.

How do I check how old a domain is?

Enter it above. The Registration section shows the creation date from the registry’s RDAP record, or from its WHOIS server when RDAP doesn’t answer, with the age in days, months or years and the days left until expiry. Dates are the registry’s, in UTC. For the raw text from every WHOIS server, use the WHOIS lookup.

Why does it say a domain doesn’t exist?

Only when DNS answers NXDOMAIN for the domain’s A, MX, NS, TXT and SOA records. If the registry still knows that exact name, the result says it is registered but doesn’t resolve, as for a domain on hold. A missing name under a registered domain points you to the registered one. If the registry couldn’t be checked, the message says so, and the WHOIS lookup can tell.

What do the domain status codes mean?

They are the registry’s EPP status flags. clientTransferProhibited is the registrar lock that stops unauthorised transfers; serverTransferProhibited is the stronger registry lock. clientHold or serverHold take the domain out of DNS, and redemptionPeriod or pendingDelete mean it expired and is about to be released.

Does it touch my servers?

No. It only reads public DNS through Cloudflare and Google DNS-over-HTTPS and the registry’s public RDAP record (or its WHOIS server when RDAP doesn’t answer). Nothing is sent to the domain’s own servers. zerobounce.ai’s own logs don’t keep the domain you enter; Cloudflare’s request logs do, as the privacy page explains.

How fresh are the results?

Live lookups, kept in the edge cache for two minutes so repeat views are fast. Check again bypasses the cache.