About this console
Pikkola, tool No. 18
Two public resolvers, asked the same question at the same moment, with the answer printed for both.
Why two resolvers
Most lookup pages ask one resolver and print what comes back, which is fine until you change a record. Then the same page gives you two different answers an hour apart and no way to tell whether the change is still spreading or never landed.
Two large resolvers on separate networks answer that. If both agree, the record has reached both of their caches, which are fed by different paths. If they disagree, the difference is the information: one cache is still holding the old TTL, or the zone has two records on the same name that should not be there together.
There is no third resolver because a third would mostly add traffic. The two here are enough to see a difference, and every additional resolver is another company that sees which names you are curious about.
What the timings and TTLs mean
The time next to each answer is measured in your browser, from the moment the request leaves to the moment the JSON is parsed. It includes your connection, DNS-over-HTTPS is done over TLS, and the resolver's own work. That is deliberately the number a visitor to your site would feel, not a number taken from a server in a datacentre.
The TTL is different: it is the resolver's instruction to itself. It says how many seconds this answer may be reused before asking again. A record changed five minutes ago with a TTL of 3600 will keep being served from caches, including these two, for up to an hour. Raising a TTL before a move, and lowering it well before, is the part of a migration people skip.
How the mail panel reads a domain
SPF is a TXT record on the domain itself, starting with v=spf1. DMARC is a TXT record at _dmarc.yourdomain, starting with v=DMARC1, and it is a list of semicolon separated tags: p is the policy, rua the address for reports, pct the share of mail it applies to, sp the policy for subdomains.
Both are printed exactly as the resolver returned them, then read out in plain sentences. Where the policy is weak, the panel says which part is weak rather than giving the domain a score. A single number would hide the difference between p=none with reports and p=none without, which are very different situations.
What it does not do
It does not check DKIM, because a DKIM key lives under a selector the domain chose and DNS cannot list selectors. It does not query a domain's own authoritative name servers directly, which some propagation tools do; those tools give a wider picture and are worth using when the two public resolvers disagree.
It does not tell you whether a zone is configured correctly in the sense your host means. It reports what the public DNS says, which is what everyone else sees, including the parts your host would rather not discuss.
If something is wrong
Write to hello@pikkola.com with the domain, the record type and the browser. Do not send a private key or anything you would not put in a public zone file.