Which nameservers answer for the domain, and their IP addresses
Finds the nameservers for the zone the domain belongs to, and resolves each to an IP address. Subdomains without their own nameservers show their parent zone's.
The nameservers tell you who runs the domain's DNS, which is often a different company from the one hosting the site. Domains sharing an unusual set of nameservers are usually managed by the same people.
A, AAAA, MX, NS, CNAME and other records held for the domain
TXT records, including domain verification and policy entries
Registrar, registration dates and nameservers, from WHOIS
Ownership and contact details published against the domain
DNSSEC records proving DNS answers have not been tampered with
Subdomains that have appeared in public Certificate Transparency logs