DNS resolution
DNS Look sends one DNS-over-HTTPS request for each requested record type. Cloudflare’s validating resolver is used first, with Google Public DNS as a fallback when the first resolver times out or returns a server failure. The all-record report does not use an ANY query.
Answers are normalized into a shared shape while preserving record-specific fields such as MX preference, SRV weight and port, SOA timers, and CAA tags. DNS response codes such as NXDOMAIN and SERVFAIL are kept distinct from an empty answer.
Caching and timing
Positive answers are cached briefly using their returned TTL, bounded to prevent stale reports and excessive upstream traffic. HTTP caching may serve a recent result while it is revalidated. Different resolvers can legitimately show different answers during a DNS change.
DNSSEC
The resolver’s authenticated-data signal is displayed when present. The DNSSEC checker also requests DS and DNSKEY records. A complete assessment still requires a valid chain from the parent DS record to the child zone’s signing keys and signatures.
Registration data
The WHOIS/RDAP tool downloads IANA’s DNS bootstrap directory, selects the service for the domain’s top-level domain, and requests the domain object from that service. Fields may be missing or redacted according to the registry, registrar, and applicable policy.
Domain health scoring
The health score summarizes the presence and consistency of a small set of public configuration signals. It is not a vulnerability scan, compliance assessment, uptime test, deliverability guarantee, or security certification.