What the domain report checks
A domain is not one thing. It is a registration held at a registry, a set of DNS records served by nameservers, one or more servers that answer on the IP addresses those records point to, and usually a mail setup that lives somewhere else entirely. Problems tend to appear in the gaps between those layers, so the report looks at all of them in a single pass.
The registration section comes from RDAP, the structured successor to WHOIS: registrar, creation, update and expiry dates, status codes, nameservers and DNSSEC state. The DNS section queries public recursive resolvers for A, AAAA, NS, MX, TXT, CAA and SOA records. The mail section reads MX, SPF and DMARC. The hosting section maps each IP address to its network owner. The web section makes one HTTPS request and records redirects, the response status and the certificate the server presented.
How to read the results
Start with the dates. An expiry date a few weeks away on a domain you depend on is the most common and most expensive surprise in this field. Then check that the nameservers listed at the registry match the NS records the zone itself returns; a mismatch usually means a half-finished migration.
Next, compare hosting and mail. It is normal for a website to sit behind a CDN while mail goes to a separate provider. What matters is that each part points where you expect. If the report names a network you do not recognise, that is worth a closer look before it becomes an incident.
Source and time on every section
Domain data ages quickly and tools that hide this cause confusion. Each section of the report states its source, such as the registry RDAP server or a public resolver, and the time of the observation. If one source fails or times out, that section says so and the rest of the report still renders. A missing answer is shown as unknown, never filled in with a guess.
What a domain lookup cannot tell you
The report sees what the public internet sees. It cannot read a private zone file, list every subdomain, reveal an origin server hidden behind a CDN, or identify a registrant whose contact data is redacted. It does not judge whether a site is safe or trustworthy. A valid certificate proves that traffic is encrypted to a server controlling the name, nothing more.
Treat the output as evidence to reason with. For legal questions about ownership, the registrar and the registry are the authoritative parties, not any lookup tool.
From one lookup to ongoing tracking
A single lookup answers a question for today. If the domain is yours, or one your business relies on, you can add it to a portfolio in the OrbitProbe workspace to get renewal reminders, or create a watch that compares DNS answers over time and records changes. Both are optional; the lookup tools work without an account.