Passive Footprint Report
A one-page report of what a domain's public records reveal: DNS, mail policy, hosting network, registration and certificate-log names. Its web and mail servers are not contacted.
Looks up live data What you enter is sent to our server to fetch live results from public sources. Results are cached briefly. A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
A passive report from public records: DNS over HTTPS, Team Cymru, RDAP registration data and Certificate Transparency logs, all fetched through our server. Neither your browser nor our server contacts the domain's web or mail servers. The domain name is sent to Cloudflare's DNS resolver (which asks the domain's own name servers), to rdap.org and the registry's RDAP server, and to crt.sh or Cert Spotter; Team Cymru sees only the IP addresses. A Cloudflare Turnstile check runs when you press the button.
Findings
Providers are inferred from names in public records; a name can appear without a service being active. Use this only on domains you own or are allowed to assess.
Report a problem with this tool
About this tool
This report gathers what anyone can learn about a domain without touching it. It reads the domain's address, name server, mail, TXT and CAA records and its DMARC record over DNS-over-HTTPS from Cloudflare's public resolver, finds which network announces each address (autonomous system, organisation, country) through Team Cymru's DNS service, reads reverse DNS names, and fetches registration data (registrar, dates, status, DNSSEC) through RDAP. It then adds the names found on the domain's public certificates from Certificate Transparency logs. From these it writes findings: no or weak SPF, DMARC policy none, no CAA, a single name server, DNSSEC state, a registration that is about to expire or was made days ago, and certificate names that look like test, admin, internal or build hosts. Providers such as Google Workspace, Microsoft 365, Cloudflare or Fastly are inferred from the names in MX, NS, SPF and verification records, so treat them as hints. Registrant and contact details are never read. The domain you enter goes through our server to the public services named above (Team Cymru sees only IP addresses), and neither your browser nor our server contacts the domain's own web or mail servers. A subdomain is reported as its registrable domain. SPF lookups are counted for the top-level record only; use the email authentication checker for a full SPF walk.
How to use it
- Enter a domain such as example.com.
- Press Build report and wait; the certificate-log step can take longer for a large domain.
- Read the findings first, then open the sections for the records behind them.
- Copy or download the report as Markdown for your notes or a ticket.
Common problems
- The registration section is missing
- Not every registry offers RDAP through rdap.org. The rest of the report is unaffected.
- The certificate-log names could not be fetched
- crt.sh and Cert Spotter are sometimes unavailable. Build the report again in a few minutes, or use the CT subdomain enumerator on its own.
- The hosting shows a CDN, not the real server
- A domain behind Cloudflare, Fastly or Akamai publishes the CDN's addresses. The origin server is not visible from public records.