How it works
inspect.ZONE answers one question honestly: what do the servers actually responsible for your domain say about it, right now? To do that it behaves like a resolver doing a fresh lookup from scratch, and never asks anyone else's cache.
No recursive resolver
Most DNS checkers ask a public recursive resolver such as 8.8.8.8 or 1.1.1.1, then show you whatever that resolver returns. That hides exactly the things a health report should expose: which nameserver answered, whether it answered authoritatively, whether the parent delegation matches the child, whether serial numbers agree across servers. A resolver merges all of that into one cached answer.
This tool never uses the system resolver or a public one. It carries the root hints in the repository and does the resolution itself, so every answer in the report is tied to the specific server that gave it.
Walking the delegation from the root
Starting from a root server, the tool asks which nameservers run your top-level domain, then asks one of those which servers run the next label down, and so on until it reaches the servers delegated for your exact domain. The parent is not always the TLD: registry-level zones like co.uk have their own level, and the walk follows the real delegation rather than guessing from a public suffix list.
Along the way it records the parent server that answered, the full delegation (the NS records and any glue), and the addresses each nameserver hostname resolves to.
Querying the authoritative servers directly, in parallel
With the authoritative servers known, the checks query them directly. Queries are sent to all of the servers at once over UDP, falling back to TCP when a response is truncated or a check needs it, with short timeouts and one retry. The transport refuses to send to private, loopback, or otherwise non-global addresses, whatever a delegation claims; a nameserver on a private address is reported as a finding, not queried.
Comparing answers, server by server
Because each answer is tied to a server, the report can compare them. It flags SOA serials that disagree between nameservers, NS or MX sets that differ depending on who you ask, glue that is missing or wrong, nameservers that answer recursive queries they should not, mail policy records, and the DNSSEC chain from the DS record at the parent to the signature on the SOA. Each finding says what was found, why it matters, and cites the RFC where one applies.
Fast, and gentle on the servers
A whole report runs inside a single web request, targeting a few seconds for a healthy domain. Delegation data for shared parents (the root and TLD servers) is cached within their DNS time-to-live, so repeated reports barely touch the root and TLD servers. A finished report itself is reused for a short time; that is what the Cached label means, and Pull a fresh report forces a new run.
What it does not do
It makes no changes to your DNS, needs no account, and contacts no third-party service to produce a report. It cannot see private or split-horizon views that are not published to the public authoritative servers, and it reports what those servers return at the moment you run it.