Who the domain is registered with, when it expires and its status at the registry, from the registry's RDAP or WHOIS service. It's only looked up when you ask, to keep the load on registries down.

Look up registration data for dnssec-failed.org

NS records name the servers that are authoritative for the domain: the ones every other answer ultimately comes from.

No NS records were found.

A and AAAA records give the IPv4 and IPv6 addresses the name points to, usually its website. Reverse DNS (PTR records) names each address back, which often shows who hosts it.

No A or AAAA records were found.

DNSSEC signs a zone's records so resolvers can check they haven't been forged or altered. Each zone's keys are vouched for by a DS record in its parent zone, forming a chain of trust up to the DNS root.

The domain is signed, but its signatures don't validate. Validating resolvers, including 1.1.1.1, 8.8.8.8 and most ISPs', will refuse to answer for it, so to many people it will look like it doesn't exist.

Zone signed

Yes, it publishes DNSKEY records

Delegation signed

Yes, the parent publishes DS records

Denial of existence

NSEC

Automated DS updates

No CDS or CDNSKEY records

Keys (DNSKEY)

Delegation signer records (DS, in the parent zone)

Signatures (RRSIG)

CAA records say which certificate authorities (CAs) may issue TLS certificates for the domain, which guards against certificates being issued by a CA the owner doesn't use. A CA can also be limited to one ACME account, or to certain ways of proving control of the domain (RFC 8657).

There are no CAA records, so any certificate authority may issue certificates for this domain.

TXT records hold free-form text. Most are left by services checking that the domain's owner uses them, so together they hint at which services an organisation signs up for. SPF records are explained under Mail.

No TXT records were found.

HSTS preloading builds a domain into browsers' lists of sites that must only be loaded over HTTPS, so even the very first visit can't be downgraded to plain HTTP.

dnssec-failed.org isn't on Chromium's preload list.

MX records name the servers that receive mail for the domain, tried in order of preference, lowest first.

No MX records were found. Senders may fall back to the domain's own address.

SPF lists the servers allowed to send mail on behalf of the domain, which helps receivers spot spoofed mail.

No SPF record was found.

DMARC tells receivers what to do with mail that claims to be from the domain but fails SPF and DKIM checks, and where to send reports about it.

No DMARC record was found at _dmarc.dnssec-failed.org.

MTA Strict Transport Security lets a domain insist that mail sent to it is delivered over TLS, to servers with valid certificates, so it can't be intercepted or downgraded. It needs both a DNS record and a policy file served over HTTPS.

DNS record

No record was found at _mta-sts.dnssec-failed.org.

Policy

No policy was found at https://mta-sts.dnssec-failed.org/.well-known/mta-sts.txt.

Brand Indicators for Message Identification lets a domain with a strict DMARC policy publish a logo for mail clients to show next to its messages.

No BIMI record was found at default._bimi.dnssec-failed.org.

The Bluesky social network, built on the AT Protocol, lets people use a domain as their handle. The domain proves it with a DNS record naming the account's DID.

No AT Protocol record was found at _atproto.dnssec-failed.org.