Space Plexus Gateway
DNS Lookup
Look up any domain over DNS-over-HTTPS. Get a quick overview with IP geolocation, or sweep every record type and discover subdomains.
Ready
Pick a tab below to begin.
Domain / IP Info
Put in a domain (or an IP) and get its registration (WHOIS), addresses, reverse DNS, nameservers, mail servers, and the approximate location of each IP.
A hostname resolves to its IPs; an IP address is reverse-looked-up. Both are then geolocated.
Queried over DNS-over-HTTPS from this browser.
Enter a domain or IP, then Look Up.
Domain Sweep
Query every record type at once and discover subdomains.
Apex domain or hostname. A full URL is trimmed down to its host automatically.
Both are queried over DNS-over-HTTPS from this browser.
Deep is the default: it walks the NSEC3 chain on DNSSEC-signed zones to recover subdomains, then probes well-known SRV services, DMARC, DKIM, MTA-STS and ~60 common hostnames. Standard queries only the domain you typed.
Records found by type
Count of records returned per DNS record type.All Records
No lookup has run yet.
How this works
NotesBrowsers cannot send raw DNS queries, so this page uses DNS-over-HTTPS (JSON) against a public resolver. Each record type is requested separately and the answers are merged below.
There is no single query that returns every record. ANY is asked for, but most modern resolvers
answer it with a stub reply instead of the full zone — see
RFC 8482. That is why every type is swept individually.
SRV records live under service prefixes such as _sip._tcp.example.com, and
DKIM keys live under selector names that are not discoverable from DNS alone. Deep mode — the
default — probes a list of well-known prefixes and selectors, so a blank result there means "none of the common
names existed", not "none exist".
A records on subdomains are the big catch. DNS cannot list the names inside a zone — there is no
"give me everything" query, and public servers rightly refuse zone transfers. A record at
plex.example.com is invisible unless you already know the name. On DNSSEC-signed zones, deep mode
works around this by walking the NSEC3 chain (below); it also tries a list of ~60 common hostnames. Everything is
plain DNS over the chosen resolver — no account, API key, or third-party service is used.
NSEC3 zone walking. A DNSSEC zone signed with NSEC3 answers "this name does not exist" with a signed proof that contains a hash of every real name plus its record types. Deep mode sprays lookups to collect those proofs, reports the true record count from them, and cracks the hashes locally (in your browser, against a built-in wordlist) to recover the names. It reads only published DNSSEC data.
What still cannot be found automatically: a name with an unguessable spelling whose NSEC3 hash the wordlist does not crack. Nothing outside your own DNS records can reveal it — if you know the hostname, use the Domain Info tab to look it up by name.
Results reflect what the chosen public resolver returns, including its cache. Split-horizon or internal-only zones will not appear.