What tools you use to check your website’s infrastructure?

Now imagine you’re given an unfamiliar domain name whose underlying workings you have to discover. Who’s hosting it, is it on a CDN such as CloudFlare, where its DNS is hosted, what are the details in its server headers, how its SSL certificate is configured.

And then there’s a second level. What technologies is the website using, does it have sub-domains for other services, where does it send its email traffic, and, more importantly, can you discern the real source behind the website if there’s a CDN in front of it?