Live DNS and domain intelligence: record lookups across every type, propagation checks against six public resolvers worldwide, WHOIS with parsed expiry dates, reverse DNS, and the email-authentication trio of SPF, DKIM and DMARC.
The email checks matter more than they look: domains without DMARC can be spoofed in phishing mail wearing your name, and mailbox providers increasingly junk unauthenticated senders.
One thing explains most of the confusion in this category: caching. Every resolver between a visitor and the authoritative nameserver may hold an answer until its TTL expires, so a record you changed an hour ago can still be the old value for somebody else, and two correct lookups can disagree. Lower the TTL before you plan a change rather than after, and when a result looks wrong, check it against the authoritative nameservers before assuming something is broken.