ToolsEmail

Domain service profile

What is this domain set up with? Enter a domain to see which email and cloud services it uses, as anyone on the internet can see them. Every conclusion lists the DNS records behind it. It's also a way to see your own domain as an outsider does.

Records are read and interpreted in your browser
DNS lookups sent via abbott.cloud to Cloudflare's resolver

Domain

How this works

Your browser builds 26 DNS questions about the domain: its MX, TXT, NS and CAA records, DMARC, MTA-STS and TLS reporting records, ten well-known DKIM selector names, and the names Microsoft 365 asks domains to publish for Autodiscover, Teams, device registration and Intune.
Browsers can't send DNS packets, so the questions go to abbott.cloud/api/dns in two requests (at most 20 questions each), which forwards them unchanged to Cloudflare's resolver (1.1.1.1) using DNS over HTTPS (RFC 8484).
This page matches what comes back against tables of provider names it is sure of: MX hosts, SPF includes, DKIM targets and verification tokens. A match becomes a conclusion with the matching record shown beside it. A record that matches nothing is listed as published and never guessed at.
Where mail goes to a security gateway but SPF, Autodiscover or DKIM point to a mailbox service, the page says mail reaches the gateway first and the mailbox service second. That second step is an inference, and says so.
Microsoft 365 DKIM records are CNAMEs whose targets contain the tenant's initial domain, so the tenant name can be read from them (Microsoft Learn, "Set up DKIM to sign mail from your cloud domain").

What's kept: nothing. The domain goes in the page's address so you can share the result, but it isn't stored.

Limitations:

DNS shows how a domain is set up, not whether the setup is used. Records can be old or forgotten.
SPF includes aren't followed, so providers named only inside another include aren't found. The SPF checker expands every include.
DNS can't list a domain's names or DKIM selectors, so only the well-known ones are tried. A miss doesn't mean a service isn't used.
Whether a Microsoft 365 domain is managed or federated, and the tenant ID, come from Microsoft's sign-in service. This site doesn't contact it.

Code: tenant.js (this page), tenantprofile.js (the tables and the reasoning), spf.js, dmarc.js, mailpolicy.js, net.js (requests).