Runs entirely in your browser — no server involved. MX, SPF, DMARC and DKIM come from real DNS lookups via Cloudflare's public DNS-over-HTTPS resolver, including every include: and redirect= SPF pulls in — expanded recursively, with a running count against the RFC 7208 10-lookup limit a real mail server enforces. WHOIS data comes from RDAP, the modern HTTPS-based replacement for the WHOIS protocol; real WHOIS itself needs a raw network connection no browser can make, so a handful of registries that haven't published an RDAP server (.io and .co among them) won't return anything here — that's a gap in the registry's own service, not a failed lookup.