CAA lookup

CAA tells certificate authorities who may issue for the domain (RFC 8659): issue for ordinary certificates, issuewild for wildcard ones, iodef where a refused request is reported. It matters for mail too: the MX hosts' certificates and the one at mta-sts. must come from an authority allowed here.

• NXDOMAIN, NODATA or an error

  NXDOMAIN: the name does not exist. NODATA: the name exists but lacks the type asked (RFC 2308 §2.1, §2.2). Both are definite answers. A timeout or SERVFAIL says nothing about the record, so we show them as "unavailable".

• TTL

  How long the answer may be cached, in seconds; the number shown is what is left in our resolver's cache. Negative answers are cached too, at most for the SOA MINIMUM field (RFC 2308 §4, §5): a newly created record may only appear after it.

• DNSSEC

  "DNSSEC validated" means our resolver checked the signatures and considers the answer authentic (the AD bit, RFC 4035 §3.2.3). "No DNSSEC": the zone is not signed, or the chain of trust does not reach it.

• Aliases (CNAME)

  A CNAME points a name at another, and the resolver follows the chain and answers for its target (RFC 1034 §3.6.2). A name with a CNAME can have no other records, and MX and NS must not point at an alias (RFC 2181 §10.3).

Sources: RFC 1034 · RFC 1035 · RFC 2181 · RFC 2308 · RFC 4035 · RFC 8659