Everything you need to see DNS clearly.

How ASN Lookup finds the owner, prefixes, upstreams and downstreams of an autonomous system, where its RIPEstat and Team Cymru data come from, and its limits.

What the DNS Security Posture Report shows: Market Index DNS scores side by side for public companies, colleges, hospitals and non-profits. A paid plan feature.

Learn how Domain Visualizer scans domains, what each scan mode covers, how scoring works, what the graph means, and which privacy limits apply.

How Domain Visualizer works: input checks, the exact DNS-over-HTTPS lookups by mode, follow-ups, request budget, findings and their limits, scoring and caching.

What the Healthcare Market Index covers, where its CMS hospital data comes from, how often hospitals are scored, and what hospital type and ownership mean.

What the Higher Education Market Index covers, where its IPEDS data comes from, how often colleges are scored, and what the Carnegie classification means.

How IP WHOIS Lookup finds the right regional registry over RDAP, follows referrals, builds the allocation path from IANA to the network, and what it shows.

Learn how Market Index ranks S&P 500 DNS posture, what freshness badges mean, and how to pivot from sector trends into company-level DNS evidence.

How the Market Index builds its S&P 500 list, fetches delayed prices, computes DNS scores on a rotating schedule, and caches the page.

What the Non-Profit Market Index covers, where its IRS data comes from, how often charities are scored, and what the NTEE cause groups mean.

How the Ping tool sends real pings from Globalping probes, the options and limits, how loss and jitter are calculated, and what TCP connect measures.

How the Search and AI Optimizer reads robots.txt, sitemaps, feeds and llms.txt, its crawl limits and safe fetching, and how crawler access is simulated.

How the Subnet Calculator reads IPv4 and IPv6 input, computes masks, ranges and host counts, handles /31, /127 and special ranges, and maps blocks to reverse DNS zones.

How the TCP Port Check connects to a host and port, how open, closed and filtered are decided, what it never connects to, and its limits.

How the Traceroute tool runs mtr on Globalping probes, what each hop shows, how loss and latency jumps are judged, and the limits of a remote trace.

Learn how Website Recon normalizes inputs, infers likely providers, reports evidence and caveats, and handles CDN-fronted domains conservatively.

How Website Recon normalizes input, resolves DNS, enriches with RDAP and network data, scores provider matches, and builds abuse-reporting guidance.

Learn how Zone Analyzer parses local DNS exports, applies filters, exports CSV, and limits visual verification to explicitly selected web-facing rows.

How Zone Analyzer parses zone exports in the browser, which records it treats as web-facing, and how screenshots and HTTP status checks work.

How DNS delegation works through NS records in the parent and child zones, when glue records are required, and how to spot broken delegations.

Understand common DNS record types including A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, and SRV, plus where they are used.

Learn what a DNS TTL is, how resolvers and other caches use it, how to choose TTL values, and how to lower TTLs safely before a planned change.

What happens after a domain expires: auto-renew grace, redemption, pending delete, why registry and registrar expiration dates can differ, and when a domain really becomes available.

Follow a DNS lookup from the application to the stub resolver, recursive resolver, root, TLD and authoritative servers, and see where caching helps.

Use dig, nslookup, host, whois, and delv to troubleshoot DNS, verify records, inspect delegation, and query registration data.

Learn the roles of recursive resolvers, root servers, TLD servers, authoritative servers, and hidden primaries in DNS.

Understand what a domain registrar does, how it differs from a registry, and which parts of your domain configuration it controls.

Learn what DNS is, how a DNS lookup works, and why recursive resolvers, authoritative servers, caching, and records matter.

Learn what WHOIS information is, what registration data can reveal, why some fields are redacted, and how RDAP relates to WHOIS.

DNS changes are not pushed out: resolvers keep old answers until the previous TTL expires. What really sets the wait, and how to check it.

What DNS SERVFAIL means, its common causes, and how to tell DNSSEC failures from broken name servers with paired dig, +cdflag, delv and EDE checks.

What a lame delegation is, how it happens, how to test every listed name server with dig, and how to fix it.

What NXDOMAIN, NODATA, REFUSED and SERVFAIL mean in a DNS response, how to tell them apart with dig, and where each one tells you to look next.

Split-horizon DNS answers differently inside and outside your network. How it is built, what goes wrong, and how to compare the views.

A practical guide to identifying dangling DNS records and preventing subdomain takeover attacks.

How wildcard DNS records really match, why the risk depends on what they point at, how to test for one, and how to use them safely.

A practical guide to BIMI: what it is, required DNS records, DMARC prerequisites, and how inbox logo display works.

How DNS-based blocklists such as Spamhaus, SURBL, URIBL, SpamCop and PSBL work, why a listed domain or mail server loses email and trust, how to check a listing yourself, and how to fix the cause and request removal.

Understand DANE for SMTP, TLSA records, DNSSEC prerequisites, and certificate verification flow for secure mail transport.

Understand HTTPS TLSA records, DNSSEC requirements, malformed-record findings, and the limits of DANE support in web browsers.

How DKIM signs email, how selectors publish public keys in DNS, which key sizes to use, and how to rotate DKIM keys without failed signatures.

How DNS amplification reflects spoofed queries at a victim, and how to keep your servers from being used: no open recursion, RRL, BCP 38.

How DNS cache poisoning works, from the Kaminsky attack to SAD DNS, and the defences: DNSSEC, randomisation and validating resolvers.

How DNS firewalls block malicious domains at the recursive resolver, how Response Policy Zones encode triggers and actions, and where they fall short.

How DNS tunneling hides data in queries to an attacker-controlled domain, the signs to look for in resolver logs, and how to block it.

Unsigned zones still resolve; broken DNSSEC makes validating resolvers return SERVFAIL. How to tell the states apart and fix a broken chain.

How to roll DNSSEC zone-signing and key-signing keys safely, which waits matter at each step, and how CDS and CDNSKEY automate DS updates.

How domain hijacking works, what EPP lock statuses really block, and how registry lock and monitoring protect the domains you cannot afford to lose.

What domain status codes such as clientTransferProhibited and serverUpdateProhibited mean, how registrar and registry locks differ, and what a missing lock does and does not tell you.

How SPF, DKIM and DMARC work together to stop attackers sending mail as your domain, with a diagram of every check and a safe path to p=reject.

How internationalized domain names work, what Punycode and xn-- labels are, and why mixed scripts and lookalike characters can signal a phishing domain.

How attackers register domains that look like yours (typos, swapped letters, other TLDs) and set them up for email to run phishing and invoice fraud, how to check which exist, and how to monitor, block and take them down.

How MTA-STS forces authenticated TLS for inbound mail, how TLS-RPT reports delivery failures, and how to roll both out safely from testing to enforce.

Why STARTTLS alone leaves server-to-server email open to downgrade and interception, and how DANE TLSA records make senders insist on the right certificate.

What security.txt is, where it lives, which fields RFC 9116 defines, common mistakes, and how Website Recon uses it to find the right person to tell about a hacked site.

The most common SPF and DMARC mistakes, what each one breaks, how to check your records by hand, and how to fix them, updated for RFC 9989.

What CAA records do, how issue, issuewild and iodef work, how CAs search for CAA, and the mistakes that block certificate issuance.

Why a CNAME cannot sit at the zone apex, and how ALIAS records, CNAME flattening and HTTPS AliasMode let a bare domain point at a hostname.

How resolvers cache NXDOMAIN and NODATA answers, how the SOA minimum field and SOA TTL set the negative TTL, and how to choose a sensible value.

How reverse DNS maps IP addresses back to names with PTR records, who controls them, and why mail servers and logs depend on them.

What each SOA field does, sensible values for refresh, retry, expire and the negative TTL, and the serial mistakes that stall secondaries.

How SRV records work: priority, weight, port and target, the enterprise SRV names you will meet, and the mistakes that break service discovery.

How SVCB and HTTPS DNS records from RFC 9460 tell clients which protocols, ports and endpoints a service supports before they connect.

What TXT records carry beyond SPF: DMARC, DKIM, MTA-STS, BIMI and verification tokens, where each lives, and the format details that cause trouble.

Debug DNSSEC validation errors step by step: confirm validation is the cause, compare DS with DNSKEY, check signatures, and fix the broken link.

Intermittent DNS failures usually come from one bad path. How to test each name server, resolver and transport until one fails every time.

A step-by-step playbook for moving a zone to a new DNS provider: lower TTLs, copy and compare the zone, hand over DNSSEC, swap NS records, and monitor.

Why a domain resolves on one network but not another: find each network's resolver, compare answers, and test DNSSEC, filtering and caching differences.

Troubleshoot email delivery from the DNS side: MX routing, MTA-STS and DANE, SPF, DKIM selectors from real headers, DMARC alignment and reverse DNS.

A step-by-step check for a domain that will not resolve: registration, delegation, name servers, the record, DNSSEC, then caches.

Use Certificate Transparency logs and crt.sh to inventory the hostnames in your own certificates and find forgotten or dangling DNS records.

How to read dig output, the flags and options that matter, and the dig commands to reach for when troubleshooting DNS.

How to test DNS over HTTPS with curl, dig and kdig: JSON APIs versus the RFC 8484 wire format, reading the answer, and comparing DoH with classic DNS.

How to use nslookup on Windows, macOS and Linux: query any DNS server, look up record types, run forward and reverse lookups, and read the output.

nslookup and dig side by side: equivalent commands, what each can and cannot show, and why their answers sometimes differ.

WHOIS vs RDAP: how they differ, why RDAP is the official gTLD source since January 2025, and how to query and read RDAP with curl and jq.

Anycast announces one DNS server address from many sites. What it gives you, what it does not, and how to see which site answered.

How EDNS lets DNS answers exceed 512 bytes, why 1232 bytes is the safe UDP size, and how truncation and TCP fallback keep large answers working.

How GeoDNS and DNS load balancing return different answers by location, weight or health, how EDNS Client Subnet helps, and where caching limits them.

A hidden primary feeds public secondaries by zone transfer and never answers the public. How to set it up, secure it and monitor it.

How to run two DNS providers at once: keeping zones in sync, DNSSEC with two signers, and the features that do not carry over.

How recursive resolvers cache, pick servers, validate DNSSEC, fall back to TCP and serve stale data, and how each affects your domain.

Authoritative servers answer for their own zones; recursive resolvers look names up and cache them. How to tell them apart with dig.

DNSSEC signs the records; DoH encrypts the hop to your resolver. What each protects, what it does not, and why you want both.

How DNS over HTTPS, DNS over TLS, and DNS over QUIC encrypt queries, how they differ on ports, performance, and network control, and when to use each.

When one anycast DNS provider is enough and when a second is worth the extra work, with the trade-offs side by side.

Wildcard DNS records compared with explicit records: inventory, failure behavior, certificates and scope, and when each one is the right choice.

What an autonomous system and its ASN are, who assigns them, which numbers are reserved, and how upstreams, peers and downstreams connect networks on the internet.

Learn how BGP connects autonomous systems, how routers pick a best path, and why routing decisions shape which DNS servers your queries reach.

How BGP hijacks and route leaks misdirect traffic, how RPKI ROAs and route origin validation stop many of them, and how to protect your DNS servers.

A reference to the most common TCP and UDP port numbers for web, email, DNS, remote access, file sharing, VPNs and databases, with which ones should never face the internet.

How CDNs use CNAME chains, DNS-based steering, anycast, and EDNS Client Subnet to send each user to a nearby edge server, and how to troubleshoot it.

How IANA, the five regional internet registries and providers hand out IP address blocks, what allocations and assignments mean, and how to look a block up.

Learn how traceroute, tracert, and mtr work, how to read each hop, which patterns are harmless, and which ones point to real loss or latency.

What HTTP status codes mean, from 200 OK and 301 redirects to 404, 429, 502 and Cloudflare 52x errors, what to do about each one, and what it means when a site returns no code at all.

A plain-English guide to the internet protocols you meet every day, from HTTP, DNS and TCP to SMTP, SSH, BGP and DHCP, with each one's port, the layer it runs on and the standard that defines it.

How IPv4 addresses are structured, how subnet masks and CIDR prefixes divide them into networks, and where prefixes show up in DNS work.

How IPv4 and IPv6 differ, how AAAA records publish IPv6 addresses in DNS, and how Happy Eyeballs lets dual-stack clients pick a working path.

How IPv6 prefixes divide into routing prefix, subnet ID and interface ID, why subnets are /64, common /48 and /56 sizes, and how to build a readable address plan.

How leaf-and-spine Clos fabrics work, how ECMP and oversubscription shape capacity, why BGP runs inside data centers, and where DNS resolvers fit.

Compare Layer 4 and Layer 7 load balancers: what each can see, how they handle TLS and client IPs, and how DNS points users at them.

What MTU is, how IP fragmentation and Path MTU Discovery work, and why large DNS answers over UDP should stay small and fall back to TCP.

What the RFC 1918 and CGNAT address ranges are, how NAT lets private networks share public IPs, and why private addresses do not belong in public DNS.

What ping measures, how to read round-trip time, packet loss and jitter, what normal latency looks like by distance, and why a host may not answer.

How RPKI lets address holders authorize which networks may announce their prefixes, and how to create, check and maintain ROAs without breaking your own routing.

How the TCP three-way handshake works, what makes a port open, closed or filtered, why filtered ports time out, and how to test a port yourself.

How TCP and UDP differ, why DNS sends most queries over UDP, and when it must switch to TCP for large answers, zone transfers and encrypted transports.

What the seven OSI layers and four TCP/IP layers mean, how a DNS query is encapsulated layer by layer, and how to use the models to troubleshoot.

How 802.1Q VLANs and VXLAN overlays differ, why data centers moved to VXLAN with EVPN, and what overlays change for MTU and DNS.

Follow one HTTPS page load message by message: the DNS lookup, the TCP handshake, the TLS 1.3 handshake and the HTTP request, and how HTTP/3 over QUIC saves a round trip.

What a public IP address is, why you may have both IPv4 and IPv6 addresses, how NAT and carrier-grade NAT change them, and how accurate IP location and provider data really are.

How IEEE 802.1X keeps a switch port or Wi-Fi network closed until a device authenticates, step by step through EAPOL, EAP methods and RADIUS.

How devices and users prove their identity with X.509 certificates and EAP-TLS, how to issue and protect them, and why they beat passwords and MAC addresses.

What the enterpriseenrollment and enterpriseregistration CNAME records do, what they reveal about device management, how to check them, and how to set them up for Microsoft Intune and Entra ID.

How MAC Authentication Bypass lets printers, cameras and other devices without 802.1X onto a network, what the switch sends to RADIUS and how to limit spoofing.

How RADIUS authenticates, authorizes and accounts for network access: packet types, key attributes, shared secrets, Blast-RADIUS fixes and RADIUS over TLS.

What Zero Trust means for networks: no trust from location, per-request policy decisions, the NIST SP 800-207 architecture, and a practical order to adopt it.

How Zero Trust Network Access differs from a remote-access VPN: what users can reach, where trust is decided, what is exposed, and how to migrate safely.

How clickjacking tricks visitors into clicking on your site through a hidden frame, how to check whether your pages can be framed, and how to block it with CSP frame-ancestors or X-Frame-Options.

What a Content-Security-Policy does, why a missing or weak policy leaves a site open to cross-site scripting, how to read yours, and how to roll out a strict policy without breaking the site.

When a website needs a cookie consent banner, a “Your Privacy Choices” link and a Global Privacy Control declaration, how DNS Panopticon detects trackers and consent tools, and how to set each up correctly.

What it means when a release line of PHP, Apache, OpenSSL, WordPress or similar software reaches end of life, how DNS Panopticon checks support dates, and how to plan an upgrade to a supported release.

How a website’s headers can reveal an unsupported operating system such as Windows Server 2012 R2 or CentOS Linux 7, why an OS without security updates puts the whole server at risk, and how to migrate.

Why a password field on an HTTP page, or a form on an HTTPS page that posts to an http:// address, exposes what people type, how to spot it, and how to fix the form action.

What the Strict-Transport-Security header does, how it stops SSL stripping, how to check your max-age, and how to roll out HSTS and preloading safely.

Why a website must load over HTTPS, how to tell if yours does, why the plain http:// address should redirect, and how to set up certificates and redirects on common servers.

How infostealer malware copies saved passwords and session cookies from infected computers, what it means when staff, user or supplier logins for your domain turn up in stolen data, and how to respond and reduce the risk.

What a CVE is, how DNS Panopticon matches the software versions your website reveals against the National Vulnerability Database and CISA’s exploited list, how to check and prioritise them, and how to patch.

What it means when URLhaus lists malware download links on your domain, how a hacked website ends up serving malware, how to find and remove it, close the hole that let it in, and get warnings lifted.

What mixed content is, why an http:// script on an HTTPS page is dangerous and breaks the page, how to find it, and how to fix it with https:// URLs and upgrade-insecure-requests.

What a website privacy policy is expected to cover under GDPR and CCPA, why it needs a “last updated” date and a yearly review, how DNS Panopticon checks it, and how to fix a missing, incomplete or stale policy.

What it means when Have I Been Pwned lists a breach of your website’s accounts, why old breaches still matter, and how to respond: password resets, multi-factor authentication, credential-stuffing defences and notification.

How the Referer header can leak full page addresses, including tokens, to other sites, what each Referrer-Policy value does, how to check yours, and which policy to choose.

What the Secure, HttpOnly and SameSite cookie attributes do, how a missing flag lets session cookies leak or be stolen by scripts, how to inspect your cookies, and how to set the flags.

Why Server and X-Powered-By headers that name exact software versions help attackers, how to see what your site reveals, and how to turn the version details off on common servers and frameworks.

What a trust center or security page is, what customers, auditors and procurement teams expect to find on it (attestations, subprocessors, a vulnerability disclosure policy, a status page, security documentation), and how to build one.

What MIME sniffing is, how it can turn an uploaded file into a running script, how to check for the nosniff header, and how to add it and serve correct content types.