Question 1

Which registration information is retrieved?

Accepted Answer

The registry's public data via RDAP, or via WHOIS (port 43) for extensions without RDAP such as .de or .io: registrar, creation, update and expiry dates, statuses, name servers, abuse contact. Registrant details only appear if the registry publishes them.

Question 2

How is email security graded?

Accepted Answer

Out of 100 points: SPF (25), DMARC (30), DKIM (20), MTA-STS (10), TLS-RPT (5) and DNSSEC (10). SPF is expanded include by include: beyond 10 DNS lookups it is invalid. DKIM is looked up among the most common selectors (Google, Microsoft 365, Proton…); a domain-specific selector may stay invisible. A domain without MX is graded on its protection against spoofing.

Question 3

What are lookalike domains for?

Accepted Answer

To spot domains imitating yours or a suspicious sender's: missing or doubled letter, lookalikes (paypa1, rnicrosoft), Unicode homographs, another extension or an added word (-login, -support). Each variant is checked with a public DNS query, without contacting the site; a registered lookalike publishing MX records can be used for phishing.

Question 4

Where does the data come from?

Accepted Answer

From public sources queried on the fly: RDAP and WHOIS registries, Google and Cloudflare DNS over HTTPS resolvers, certificate transparency logs (crt.sh, Cert Spotter), HackerTarget and ip-api for geolocation. The homepage, robots.txt, sitemap.xml, security.txt and the MTA-STS policy are read by our server, never from your browser. Your history stays in your browser.

Domain OSINT

A full picture of a domain in seconds