Domain name lookup
Registration records, DNS, and every subdomain that's turned up in a public certificate.
Checks run in parallel, and slow ones time out rather than hold up the rest.
What gets checked
DNS Records
A, AAAA, MX, NS, CNAME and other records held for the domain
TXT Records
TXT records, including domain verification and policy entries
Whois Lookup
Registrar, registration dates and nameservers, from WHOIS
Domain Info
Ownership and contact details published against the domain
DNSSEC
DNSSEC records proving DNS answers have not been tampered with
DNS Server
Which nameservers answer for the domain, and whether they support DoH
Subdomains
Subdomains that have appeared in public Certificate Transparency logs
What this tells you
Every domain leaves a paper trail: who registered it and when, which nameservers answer for it, what it publishes in TXT records, and which subdomains have appeared in public Certificate Transparency logs.
Registration dates and shared nameservers are how you tell a fifteen-year-old business from something set up last Tuesday.