Querying who owns what on the internet
Four tools answer a related question from different angles: what does a domain's DNS say right now, what does an IP resolve back to, who legally registered a domain, and which network operator is actually routing an IP. Used together they cover most "who is this and what's it doing" investigations — abuse reports, vendor due diligence, mail delivery debugging, or just confirming a DNS change went live.
DNS Lookup — querying records directly
DNS Lookup is the general-purpose query tool: point it at a domain and a record type (A, AAAA, MX, TXT, NS, CNAME, SOA) and it returns exactly what the authoritative servers are answering right now, bypassing any cached or stale view you might get from your own resolver.
When to use it: confirming a DNS change actually took effect at the authoritative server, debugging why a subdomain won't resolve, or reading raw TXT records (SPF strings, domain verification tokens) without guessing.
Reading results: the answer section shows the record value and its TTL. NXDOMAIN means the name doesn't exist at all. SERVFAIL usually points to a broken delegation or a DNSSEC validation failure upstream — that's a different failure mode than NXDOMAIN and needs different debugging.
Reverse DNS — IP to hostname
Reverse DNS looks up the PTR record for an IP address — the reverse mapping that tells you what hostname an IP claims to belong to. This is the opposite direction of a normal DNS lookup, and it's controlled by whoever owns the IP block (usually your hosting provider), not by whoever owns the domain.
When to use it: diagnosing mail delivery problems (many receiving servers require a matching forward/reverse pair before they'll accept mail), verifying a server's PTR was set correctly by your host, or general troubleshooting when you only have an IP and need a hostname.
Reading results: no PTR record at all is a common reason outbound mail gets rejected outright. If a PTR exists, check that it matches what the forward A record for that hostname resolves back to — a mismatch between forward and reverse also triggers spam filters, even though each record individually looks fine.
WHOIS — registration and ownership
WHOIS queries the domain registration database, returning the registrar, creation and expiry dates, current nameservers, and — where not redacted — registrant contact information.
When to use it: checking when a domain expires before it's too late to renew, identifying the registrar and nameservers when taking over management of a domain, or investigating who owns a domain during a security or abuse incident.
Reading results: most registrant fields are redacted by default under GDPR and similar privacy-proxy services — that's normal, not suspicious on its own. Expiry date and the nameserver list are the fields you'll actually use most.
ASN Lookup — which network operates this
ASN Lookup identifies the Autonomous System an IP address belongs to — the network operator responsible for routing that address block on the internet. WHOIS tells you who registered a domain; ASN lookup tells you who operates the network an IP lives on, which is a different and often more useful question during abuse or infrastructure investigations.
When to use it: identifying the hosting provider or ISP behind an unfamiliar IP, investigating abuse or traffic patterns by network owner rather than one-off IP, or researching a vendor's or competitor's infrastructure footprint.
Reading results: larger AS holders (cloud providers, major ISPs) show broad address ranges spanning many customers. A smaller, specific ASN often points to a single company running its own infrastructure — a useful distinction when you're trying to tell "shared cloud IP" from "dedicated corporate network."
Putting them together
A typical investigation chains all four: WHOIS tells you who registered the domain, DNS Lookup shows where it currently points, ASN Lookup identifies who operates that IP's network, and Reverse DNS confirms whether the forward and reverse records agree — a mismatch there is one of the most common, and most overlooked, causes of mail landing in spam.