Find the CMS, host and DNS of a website

How to use the tool

Enter a domain name, with or without https, for example example.com or https://www.example.com/blog/. The tool keeps the host name, queries the DNS servers, reads the IP address of the site, asks a public registry who holds that address, then downloads the home page to look for technology signatures.

The result comes in four blocks: the DNS records, the state of SPF and DMARC, the host or network of the IP address, and the detected technologies. Each technology is shown with the evidence that reveals it, for example a meta generator tag or a response header. A technology with no evidence is never shown. The tool accepts 20 lookups per 10 minute window and only reads public sites: private and local addresses are refused.

The DNS records the tool reads

An A record ties a name to an IPv4 address, and an AAAA record does the same for an IPv6 address.¹² A CNAME says a name is an alias of another, which happens when a site is served by a platform or a CDN.¹ An MX names the server that receives the domain’s mail, with a preference number: the lowest is tried first.¹ An NS names a name server that is authoritative for the domain.¹ A TXT carries free text, which online services use to prove that you own the domain.¹

A, AAAA and CNAME records are read on the exact name you enter. MX, NS and TXT records are read on the domain without www: if you enter www.example.com, mail and name servers are looked up on example.com, and the tool says so. For a subdomain such as blog.example.com, those three records are looked up on the subdomain itself. The tool also shows the TTL, the number of seconds during which resolvers may keep the answer in memory.

SPF and DMARC: two mail records to watch

SPF lists the servers allowed to send mail on behalf of the domain. It is published in a TXT record starting with v=spf1, and nowhere else.³ If the receiving server finds more than one SPF record on the domain, it stops with a permanent error.³ The tool therefore shows “Several” when it sees two, and reproduces their text.

DMARC is published in a TXT record placed on the _dmarc subdomain of the domain, and it starts with v=DMARC1.⁴ When more than one record remains after filtering, policy discovery stops and DMARC is not applied to the message.⁴ The tool therefore reads _dmarc.example.com, shows the published policy and flags a missing record or several records. It does not judge the quality of the SPF or the policy chosen in DMARC: it says whether the record exists, whether it is unique and what it contains.

The IP address, reverse DNS and the host

The IP address shown is the first A address of the domain, or failing that the first AAAA. The tool then looks for its reverse DNS: for an IPv4 address, a PTR record on the name built by reversing the four numbers and adding in-addr.arpa; for an IPv6 address, the same principle with the hexadecimal digits and ip6.arpa.² Many hosts publish no reverse DNS for their customers, and the tool then shows “None published”.

The host comes from RDAP, the protocol for querying IP address registries. A query on the /ip/ path followed by the address returns the most specific network that contains it.⁵ The returned object carries the block name, its handle, the first and last address, the country and the allocation type; related entities carry a role, such as registrant or abuse, and a full name.⁶ The tool shows these fields as it receives them, with the organisation holding the block when the registry declares one. The query goes through the rdap.org service, which redirects to the competent registry. The tool infers nothing: if the registry does not answer, it says so.

What RDAP names is the holder of the address block, and that holder is not always the host of the site. A site behind a CDN answers from the CDN’s addresses, and a host may lease its addresses to a reseller. When the tool detects Cloudflare or another service of this kind, it adds a line that says so.

How the CMS is recognised

The server does not send you the page, only signals: meta generator tags, a short list of response headers, cookie names, the addresses of scripts, style sheets and images, the rel values of link tags and the names of data- attributes. Your browser compares these signals with a table of signatures and shows a technology only if at least one of its pieces of evidence appears.

Some signatures are documented. WordPress announces the address of its API in a Link header and in a link tag of the page head, usually /wp-json/.⁷ The wp_generator function, hooked to wp_head, writes the generator tag.⁸ Drupal adds an X-Generator header whose value starts with Drupal, followed by the major version number and the drupal.org address.⁹ Cloudflare adds a CF-Ray header to its responses, whose three letter suffix names the data centre.¹⁰

The other signatures, for Shopify, Wix, Webflow, Squarespace, Joomla, PrestaShop and the frameworks, rest on marks visible in the code, such as the domain scripts are loaded from or the name of an attribute: the page cites no publisher documentation for them, and each detection shows its evidence so that you can judge for yourself. The table holds about thirty signatures, from CMS to web server, through CDN and language.

What the tool does not see

The home page is read before JavaScript runs, and only the first 600 KB are analysed. A technology added by a script is therefore not seen. A site can also hide its marks: removing the generator tag, renaming folders or filtering headers is a common setting. A missing signature establishes nothing about the site, and the tool only says that no signature of its list was found. A firewall that refuses robots can also block the reading of the page, in which case the DNS and host blocks are still shown.

The records are read by the nemociment.fr server, from its DNS resolver. If you have just changed a zone, the resolver may still return the old value until the TTL expires. Neither the page nor the records are kept: only a hash of your IP address is used to count the 20 allowed lookups.

Changing host: what Google says

Google devotes a page to hosting changes that keep the same page addresses.¹¹ It advises copying the site to the new host, testing it in a restricted environment or under a temporary name with indexing blocked, then checking with the URL Inspection tool that Googlebot reaches the new infrastructure without a firewall stopping it. About a week before the switch, lower the TTL of the DNS records to a few hours, so that caches refresh quickly at the moment of the change.¹¹

On the day of the switch, remove the temporary blocks from the copy (robots.txt, noindex), then change the DNS records. The logs of both servers show traffic moving from the old to the new one during propagation, and the Search Console indexing report is watched in the following days. A temporary drop in crawl rate right after launch is normal; the old host can be shut down when its logs show no more traffic.¹¹ This tool is useful before and after: before, to note the current values and TTLs; after, to check that the IP address, block and host shown are those of the new provider.

After the diagnosis

Knowing who answers does not tell you how the page answers. To read the headers the server sends, the HTTP headers analyser details each of them, and the indexability checker says whether Google can index the page once the switch is done. A change of host, CMS or domain name carries a risk for search visibility that I prepare in the SEO consulting work I do for my clients.

Frequently asked questions