A domain usually has two or more nameservers, and a normal lookup asks whichever one answers first. That hides the interesting failures. This check asks a public resolver for the delegation, then puts the same three questions to every nameserver directly: which serial the zone carries, which nameservers the zone itself lists, and which address the domain resolves to. Answers that differ are the finding.
From this server: DNS queries only, to public resolvers and to the domain's own nameservers. No web page is fetched, no cookies are sent, nothing is stored beyond the rate counter.
Limits worth knowing: at most six nameservers are queried, over UDP, and an answer larger than 4 KB is truncated. A server behind a firewall that drops UDP from unknown addresses will look silent here even though it answers resolvers normally.