Which nameservers answer for the domain, and whether they support DoH
Identifies the nameservers answering for the domain, then checks whether they support DNS over HTTPS and runs a rough test for resistance to cache poisoning.
The nameservers tell you who runs the domain's DNS, which is often a different company from the one hosting the site. Domains sharing an unusual set of nameservers are usually managed by the same people.
A, AAAA, MX, NS, CNAME and other records held for the domain
TXT records, including domain verification and policy entries
Registrar, registration dates and nameservers, from WHOIS
Ownership and contact details published against the domain
DNSSEC records proving DNS answers have not been tampered with
Subdomains that have appeared in public Certificate Transparency logs