What Can You Learn About a Domain with digga's Free Lookup Tools?

A single search on digga.dev accepts an apex domain, a subdomain, or a full URL and returns DNS records, registration data, subdomains, IP/ASN ownership, and email authentication in one report. It's free, open source under AGPL 3.0, and requires no account. Use it when you're debugging a deploy, triaging an incident, or checking how well a domain resists spoofing — not when you need a legally authoritative registration record, since RDAP and WHOIS reflect what registries publish.

One lookup, five angles

The site organizes its output into six tools behind one search box. You type a domain (or paste a URL — it figures out the apex), and the report covers:

Each area also has a dedicated page if you only need one lookup: DNS Lookup, WHOIS Lookup, RDAP Lookup, Subdomain Finder, Email Security Check, and an SSL/TLS Certificate Checker.

Reading DNS records across resolvers

The DNS tool queries live over DNS-over-HTTPS and lets you switch between Cloudflare, Google, and Alibaba DoH. That switching matters: if a record looks wrong or missing, comparing resolvers tells you whether the problem is the zone itself or propagation/caching on one resolver.

What the common types tell you:

• A / AAAA — the IPs the name currently points to; each is annotated with its network owner.
• MX — where mail is delivered; a missing or unexpected MX is a common cause of "email not arriving."
• NS — which nameservers are authoritative; useful for confirming a registrar or DNS migration took effect.
• TXT — often holds verification strings and email policy records; read it alongside the email security view rather than in isolation.
• CAA — which certificate authorities are allowed to issue for the domain.
• DNSSEC records (DNSKEY, DS) — whether the zone signs its answers and whether the delegation chain is in place.

A practical sequence for a deploy that "isn't working": check A/AAAA first, then NS to confirm you're looking at the right authoritative servers, then CNAME if the hostname is an alias.

Registration data: RDAP first, WHOIS as fallback

digga pulls structured registration data through RDAP and falls back to raw WHOIS when a registry hasn't caught up. From this you can find the registrar, nameservers, domain status, and creation and expiry dates. The fallback behavior is the useful detail — RDAP coverage isn't universal, so a tool that only speaks RDAP will show blanks for some TLDs.

Treat both as published registry data, not proof of ownership. Status codes and dates are what the registry reports.

Subdomain discovery without touching the target

The subdomain finder enumerates passively from Certificate Transparency logs and other public sources. No traffic is sent to the target, and results stream back to your browser as they arrive. This is the right approach when you want to map an attack surface or inventory your own hosts without alerting anything on the other end. Because it's passive, coverage depends on what has been logged publicly — absence of a subdomain in the results isn't proof it doesn't exist.

Email security in one view

The email security check analyzes SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI together, and validates the SPF lookup limit for you. That last check is the one people most often miss: SPF has a limit on the number of DNS-querying mechanisms it can use, and exceeding it causes a permerror that silently breaks authentication. Seeing SPF, DKIM, and DMARC side by side also makes misalignment obvious — a valid DKIM signature on a domain that doesn't match the From header still fails DMARC.

Digging from any page

Chrome and Firefox extensions let you right-click any page and dig its domain, skipping the copy-paste step. That's the fastest path when you land on a suspicious or unfamiliar site and want its DNS, registration, and email posture immediately.

When this fits and when it doesn't

Use digga for reconnaissance, debugging, and quick verification across DNS, registration, subdomains, IP ownership, and email security in one pass. Skip it if you need contractual or legal confirmation of ownership, or if you need active scanning of a target — the subdomain tool is deliberately passive, and nothing here sends traffic to the host you're researching.