DNS Inspector looks up the DNS records of a domain (A, AAAA, CNAME, MX, NS, TXT, CAA, SOA) as well as the mail authentication records DMARC, DKIM and SPF, and additionally runs a DNS security audit. The lookups are performed directly in your browser via DNS-over-HTTPS.
Enter a domain in the Target field, for example example.com, and press Inspect domain or the Enter key. A protocol prefix (http://) and a trailing dot are removed automatically. The domain is checked with a lowercase, canonical name.
DKIM keys are published under <selector>._domainkey.<domain>. Since selectors vary from provider to provider, you can enter several comma-separated selectors, for example google,selector1,selector2. In the results you will see which selectors carry a valid key.
SPF is read from the TXT record beginning with v=spf1. DMARC is read from _dmarc.<domain> and parsed into its tags. DKIM looks up the public keys of the selectors you entered. All three are shown in the results and validated in the security section.
The DNS Security section evaluates SPF validation (record present, valid syntax, DNS lookups count, catch-all), DMARC validation (record present, policy, strict alignment, reporting address), DKIM lookup (valid keys), CAA inspection (issuer entries), DNSSEC status (DNSKEY/DS records) and nameserver consistency (Google vs. Cloudflare, glue records). Each finding has a status PASS, WARN, FAIL or INFO.
Record lookups and DNSSEC are performed via Google DoH, nameserver consistency via Google + Cloudflare DoH. For the resolver comparison, lookups are also sent to DNS.SB, doh.li and AdGuard — both directly and through this server's proxy. No personal data is stored on this server. Your browser sends the queried domain name and standard HTTP connection data to the respective DoH provider.
The same records (A, AAAA, MX, NS, TXT) are also queried on several public DNS services — Google, Cloudflare, DNS.SB, doh.li and AdGuard — once directly from your browser and once through the server-side proxy. The entries should be identical everywhere; differences indicate propagation delays, DNS filtering or a client-side proxy that rewrites answers.