Lookups are made from our own recursive resolver, in our data centre in Dhaka. It resolves from the root rather than reading a shared cache, which is why a result can say where it was resolved from and why there is no rate limit for ordinary use. Public resolvers are configured behind it and answer only if ours is unavailable; the status page names each one and shows which is answering. Speed tests are measured from our nodes in Dhaka and Miami. Nothing here is a wrapper around somebody else's API.
Queries are made over EDNS0 with a TCP fallback, so a large record set is read completely rather than truncated. That detail matters more than it sounds: a truncated reply is how a checker ends up reporting that a domain has no SPF record when it plainly does.
The domain WHOIS page reads its record through our store, so what it says about availability and transfers is exactly what the store says when you click through; the record itself comes from the registry that runs the extension, with the registrar's own record followed where there is one. The IP lookup asks the address's own registry over RDAP (APNIC, ARIN, RIPE NCC, LACNIC or AFRINIC, chosen from IANA's bootstrap file), Team Cymru for the announcing AS, our resolver for reverse DNS, and DB-IP's city database for an estimated location. Every host it fetches from is a registry's; nothing you type is ever turned into a URL.
The ASN lookup reads the routing table rather than a registry's description of it. Announced prefixes, upstreams, downstreams, RPKI status and the consistency between what is routed and what is registered come from RIPE NCC's RIPEstat, which sees the table from collectors in many places rather than from one vantage point. The network's name comes from Team Cymru, its registration and abuse contact from the registry over RDAP, and its exchange and facility presence from PeeringDB. Each page lists its own sources at the bottom, so a figure you want to argue with can be traced.
The history table shows when each prefix was first and last seen announced. A prefix counts as live if a collector has seen it in the last 36 hours, because one missed update should not be reported as a withdrawal. Prefixes that are genuinely gone are kept, but capped, so a network that has renumbered several times does not push its live routes off the page.
The delegation check is the one page here that does not go through a resolver at all. It asks the nameservers of the parent zone directly, with recursion turned off, so what comes back is the referral itself rather than a cached copy of it, and then puts the same questions to each of your own nameservers in turn and compares the answers. That is how it can report a server that replies without the authoritative flag, a secondary serving a months-old copy of the zone, or a nameserver that refuses TCP. An ordinary lookup sees none of those, because an ordinary lookup succeeds most of the time and fails only on the requests that happen to land on the wrong server.
Two things about it are worth saying plainly. It sends about a dozen queries to machines we do not run, and one of them asks each nameserver to resolve a name it has nothing to do with. That is how an open recursor is identified and it is deliberately the same shape of query a scanner would send, so if you see it in your logs, that is what it was. It runs once per check and is rate limited like every other tool here.
The DNSSEC test does not validate signatures. It recomputes the fingerprint your registrar published and asks whether it still matches a key your zone actually serves. Re-signing a zone without updating the registrar produces exactly that mismatch, and it fails closed: every validating resolver refuses the domain, its mail and its website together, while the zone looks perfectly healthy to anyone checking it without validation.
The IP, ASN, DNS record, propagation and delegation lookups answer in JSON for scripts. Add format=json to the URL, or send Accept: application/json:
curl "https://www.mydchub.com/tools/asn?domain=AS63969&format=json"
Quote the URL. An unquoted & puts curl in the background in any POSIX shell, and you get a job number instead of an answer. Registry answers are cached for a day by the range they describe, so repeated lookups inside one block do not spend the registry's patience.
Without a key the form is free and needs no account, rate limited to a few calls a minute per address. Every answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Policy, so a script can slow down before it is refused rather than after. Over the limit the answer is 429 with Retry-After: 60, and the body names the page where a key comes from rather than leaving you to guess that one exists.
With a key from your workspace the call is counted against your plan's daily allowance instead, and the per-address limit does not apply. An address shared with a whole office should not be what limits somebody paying for twenty thousand calls a day. Send it as Authorization: Bearer <key>. Over the allowance the answer is again 429, and the allowance resets at 00:00 UTC. Keys are made and revoked on the Plan tab of your workspace, are shown once, and are stored here only as a hash. Pricing has what each plan allows.
There is no password and no sign-up form on this site. You sign in at your provider's customer panel and arrive here on a signed link that lasts five minutes and is removed from the address bar as soon as it is redeemed, so it cannot be screenshotted, left in browser history or leaked in a Referer header. The session it opens lasts twelve hours. Your panel already knows who you are and already handles password resets; a second credential store on a public host would only be a second thing to breach.
A workspace lets you keep a list of domains to watch. Each one is re-checked daily and you can run a check yourself at any time. If you give an address for alerts it has to be confirmed by email first, so nobody can sign you up for somebody else's reports.
Reports are not listed, indexed or shared, and they are not advertised anywhere. Anyone holding the link can read the report, so treat the link the way you would treat the result.
Site previews expire on their own after seven days. A preview gives you a DoH URL to point a device at, so it only affects a device whose owner has deliberately pointed it at our resolver, and no site traffic passes through us at any point.
Write to support@mydchub.com. If you are reporting a wrong answer, include the domain and the report link: a check that returns something incorrect is treated as a serious bug, not a cosmetic one.