The tool queries a selected resolver and groups common records: A, AAAA, CNAME, MX, NS, SOA, TXT, CAA, DS and DNSKEY. It also looks for SPF and DMARC policies published through TXT records.
A and AAAA records map a name to an IP address. MX describes mail reception, NS lists authoritative servers and SOA carries zone parameters. CAA restricts which authorities may issue certificates. SPF and DMARC help reduce email spoofing but should be combined with DKIM.
The TTL controls how long an answer may remain cached. Two resolvers can therefore temporarily show different data after a change. DNSSEC indicators report published data and, when available, validation signaled by the resolver; they are not a complete chain audit.
Check the syntax, the exact queried name and the authoritative servers first. Then compare several resolvers and wait for the TTL to expire before deciding that a change was not applied.
The analysis gathers common DNS records and highlights SPF, DMARC, CAA and available DNSSEC signals. A missing value may also depend on the selected resolver.
Caching, propagation and DNSSEC validation can temporarily produce different observations.
They reduce spoofing when correctly configured, but should be combined with DKIM and a coherent mail policy.
It indicates how many seconds an answer may remain cached.