Who the domain is registered with, when it expires and its status at the registry, from the registry's RDAP or WHOIS service. It's only looked up when you ask, to keep the load on registries down.

Look up registration data for github.com

NS records name the servers that are authoritative for the domain: the ones every other answer ultimately comes from.

NS1: Managed DNS from IBM NS1, used directly and behind platforms such as Netlify and Wix.

Amazon Route 53: AWS's DNS service.

A and AAAA records give the IPv4 and IPv6 addresses the name points to, usually its website. Reverse DNS (PTR records) names each address back, which often shows who hosts it.

DNSSEC signs a zone's records so resolvers can check they haven't been forged or altered. Each zone's keys are vouched for by a DS record in its parent zone, forming a chain of trust up to the DNS root.

The domain isn't signed with DNSSEC, so resolvers can't check that its answers haven't been tampered with on the way.

Zone signed

No DNSKEY records

Delegation signed

No DS records in the parent

CAA records say which certificate authorities (CAs) may issue TLS certificates for the domain, which guards against certificates being issued by a CA the owner doesn't use. A CA can also be limited to one ACME account, or to certain ways of proving control of the domain (RFC 8657).

Certificate issuers

• digicert.com
• globalsign.com
• letsencrypt.org
• sectigo.com

Wildcard certificate issuers

• digicert.com
• letsencrypt.org
• sectigo.com

Incident reports (iodef)

No address is given for reporting mis-issued certificates.

TXT records hold free-form text. Most are left by services checking that the domain's owner uses them, so together they hint at which services an organisation signs up for. SPF records are explained under Mail.

• 00Dd0000000hHE0=1TBKg000000TN2r
• MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805
• MS=ms44452932
• MS=ms58704441
• TAILSCALE-xOzoDvFUzZr5YYVCQFuD
• adobe-idp-site-verification=b92c9e999aef825edc36e0a3d847d2dbad5b2fc0e05c79ddd7a16139b48ecf4b
• anthropic-domain-verification-4az7qn=if8YWuRRqwLycGJDooumzHtxm
• apple-domain-verification=RyQhdzTl6Z6x8ZP4
• atlassian-domain-verification=jjgw98AKv2aeoYFxiL/VFaoyPkn3undEssTRuMg6C/3Fp/iqhkV4HVV7WjYlVeF8
• calendly-site-verification=at0DQARi7IZvJtXQAWhMqpmIzpvoBNF7aam5VKKxP
• cursor-domain-verification-gtfwmt=1rfLOtiTngX5QSxD5HvNKTvm3
• docusign=087098e3-3d46-47b7-9b4e-8a23028154cd
• facebook-domain-verification=39xu4jzl7roi7x0n93ldkxjiaarx50
• google-site-verification=82Le34Flgtd15ojYhHlGF_6g72muSjamlMVThBOJpks
• google-site-verification=UTM-3akMgubp6tQtgEuAkYNYLyYAvpTnnSrDMWoDR3o
• jamf-site-verification=XtaPNIYghF_e_xRDI8CjgQ
• krisp-domain-verification=ZlyiK7XLhnaoUQb2hpak1PLY7dFkl1WE
• loom-site-verification=f3787154f1154b7880e720a511ea664d
• miro-verification=d2e174fdb00c71e0bcf58f8e58c3da2dd80dcfa9
• openai-domain-verification=dv-3nh33eQwdkotMIAzLrIDVZo1
• serval-domain-verification-ydryhj=qbkiEakpwEpTvHh5fIiCqtaue
• shopify-verification-code=t1YPwcmvnxZyBycaCpk1MPyWoFs72o
• stripe-verification=f88ef17321660a01bab1660454192e014defa29ba7b8de9633c69d6b4912217f
• v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all

HSTS preloading builds a domain into browsers' lists of sites that must only be loaded over HTTPS, so even the very first visit can't be downgraded to plain HTTP.

github.com is on Chromium's preload list, which Chrome, Edge, Firefox and Safari all build on.

MX records name the servers that receive mail for the domain, tried in order of preference, lowest first.

Microsoft 365: Microsoft's hosted Exchange, used by most businesses on Microsoft 365.

SPF lists the servers allowed to send mail on behalf of the domain, which helps receivers spot spoofed mail.

v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114/32 ip4:166.78.69.169/32 ip4:166.78.69.170/32 ip4:166.78.71.131/32 ~all

This means:

• It will allow the IPv4 range 192.30.252.0/22.
• It will include the SPF record of spf.protection.outlook.com.
• It will include the SPF record of _netblocks.google.com.
• It will include the SPF record of _netblocks2.google.com.
• It will include the SPF record of mail.zendesk.com.
• It will include the SPF record of _spf.salesforce.com.
• It will include the SPF record of servers.mcsv.net.
• It will include the SPF record of mktomail.com.
• It will include the SPF record of sendgrid.net.
• It will allow the IPv4 range 62.253.227.114/32.
• It will allow the IPv4 range 166.78.69.169/32.
• It will allow the IPv4 range 166.78.69.170/32.
• It will allow the IPv4 range 166.78.71.131/32.
• It will softly reject everything else.

DMARC tells receivers what to do with mail that claims to be from the domain but fails SPF and DKIM checks, and where to send reports about it.

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1

Policy (p)

quarantine: Messages that fail DMARC checks will be treated as suspicious, e.g. moved to the spam folder.

Subdomains (sp)

reject: Messages that fail DMARC checks will be rejected entirely.

Applied to (pct)

100% of failing messages

DKIM alignment (adkim)

Relaxed: any subdomain of the same organisational domain counts.

SPF alignment (aspf)

Relaxed: any subdomain of the same organisational domain counts.

Aggregate reports (rua)

mailto:dmarc@github.com
Daily summaries of all the mail seen claiming to be from this domain.

Failure reports (ruf)

mailto:dmarc@github.com
Redacted copies of individual messages that failed.

Failure options (fo)

1: Report when any mechanism fails to produce an aligned pass.

MTA Strict Transport Security lets a domain insist that mail sent to it is delivered over TLS, to servers with valid certificates, so it can't be intercepted or downgraded. It needs both a DNS record and a policy file served over HTTPS.

DNS record

No record was found at _mta-sts.github.com.

Policy

No policy was found at https://mta-sts.github.com/.well-known/mta-sts.txt.

Brand Indicators for Message Identification lets a domain with a strict DMARC policy publish a logo for mail clients to show next to its messages.

No BIMI record was found at default._bimi.github.com.

The Bluesky social network, built on the AT Protocol, lets people use a domain as their handle. The domain proves it with a DNS record naming the account's DID.

DID

did:plc:sydgpvanh46u766n536r33oa

Handle

@github.com, confirmed by the DID document

Data server

https://lionsmane.us-east.host.bsky.network