Who the domain is registered with, when it expires and its status at the registry, from the registry's RDAP or WHOIS service. It's only looked up when you ask, to keep the load on registries down.

Look up registration data for nic.cz

NS records name the servers that are authoritative for the domain: the ones every other answer ultimately comes from.

A and AAAA records give the IPv4 and IPv6 addresses the name points to, usually its website. Reverse DNS (PTR records) names each address back, which often shows who hosts it.

DNSSEC signs a zone's records so resolvers can check they haven't been forged or altered. Each zone's keys are vouched for by a DS record in its parent zone, forming a chain of trust up to the DNS root.

The chain of trust from the DNS root validates, so resolvers that check DNSSEC can be sure the answers for this domain are genuine.

Zone signed

Yes, it publishes DNSKEY records

Delegation signed

Yes, the parent publishes DS records

Denial of existence

NSEC3 , 0 extra iterations , no salt

Automated DS updates

No CDS or CDNSKEY records

Keys (DNSKEY)

Delegation signer records (DS, in the parent zone)

Signatures (RRSIG)

CAA records say which certificate authorities (CAs) may issue TLS certificates for the domain, which guards against certificates being issued by a CA the owner doesn't use. A CA can also be limited to one ACME account, or to certain ways of proving control of the domain (RFC 8657).

Certificate issuers

• letsencrypt.org

Wildcard certificate issuers

None are named separately, so the issuers above apply to wildcard certificates too.

Incident reports (iodef)

No address is given for reporting mis-issued certificates.

TXT records hold free-form text. Most are left by services checking that the domain's owner uses them, so together they hint at which services an organisation signs up for. SPF records are explained under Mail.

• MS=92011E91562E6FD18FF9C5FA1F053F90DD5B1892
• v=spf1 include:_v4nets.nic.cz include:_v6nets.nic.cz include:_spf.network.cz ~all

HSTS preloading builds a domain into browsers' lists of sites that must only be loaded over HTTPS, so even the very first visit can't be downgraded to plain HTTP.

nic.cz isn't on Chromium's preload list.

MX records name the servers that receive mail for the domain, tried in order of preference, lowest first.

SPF lists the servers allowed to send mail on behalf of the domain, which helps receivers spot spoofed mail.

v=spf1 include:_v4nets.nic.cz include:_v6nets.nic.cz include:_spf.network.cz ~all

This means:

• It will include the SPF record of _v4nets.nic.cz.
• It will include the SPF record of _v6nets.nic.cz.
• It will include the SPF record of _spf.network.cz.
• It will softly reject everything else.

DMARC tells receivers what to do with mail that claims to be from the domain but fails SPF and DKIM checks, and where to send reports about it.

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc.reports@nic.cz; ruf=mailto:dmarc.reports@nic.cz; fo=1; aspf=r; adkim=r; rf=afrf; ri=86400; sp=reject

Policy (p)

reject: Messages that fail DMARC checks will be rejected entirely.

Subdomains (sp)

reject: Messages that fail DMARC checks will be rejected entirely.

Applied to (pct)

100% of failing messages

DKIM alignment (adkim)

Relaxed: any subdomain of the same organisational domain counts.

SPF alignment (aspf)

Relaxed: any subdomain of the same organisational domain counts.

Aggregate reports (rua)

mailto:dmarc.reports@nic.cz
Daily summaries of all the mail seen claiming to be from this domain.

Failure reports (ruf)

mailto:dmarc.reports@nic.cz
Redacted copies of individual messages that failed.

Failure options (fo)

1: Report when any mechanism fails to produce an aligned pass.

Report format (rf)

afrf

Report interval (ri)

Every 1 day

MTA Strict Transport Security lets a domain insist that mail sent to it is delivered over TLS, to servers with valid certificates, so it can't be intercepted or downgraded. It needs both a DNS record and a policy file served over HTTPS.

DNS record

No record was found at _mta-sts.nic.cz.

Policy

No policy was found at https://mta-sts.nic.cz/.well-known/mta-sts.txt.

Brand Indicators for Message Identification lets a domain with a strict DMARC policy publish a logo for mail clients to show next to its messages.

No BIMI record was found at default._bimi.nic.cz.

The Bluesky social network, built on the AT Protocol, lets people use a domain as their handle. The domain proves it with a DNS record naming the account's DID.

DID

did:plc:bkjpslo7o2ywxfcioymiyfx6

Handle

@nic.cz, confirmed by the DID document

Data server

https://helvella.us-east.host.bsky.network