Start with who runs the DNS
To add or change a record you have to log in wherever the DNS is hosted, and the nameserver names give that away almost every time — cloudflare in the name means Cloudflare, awsdns means AWS Route 53, gabia means Gabia. The registrar you bought the domain from is often not the same company, so do not waste time looking there first.
A CDN announces itself in the response headers
When traffic passes through a CDN, its name usually appears in the response. Cloudflare even adds its own cf-ray header. With a CDN in front, the real server address cannot be seen from outside — that is not obfuscation, it is the normal way to keep the origin from being attacked directly.
Mail often lives somewhere else entirely
The MX records reveal who receives mail for the domain, and it is common to self-host the website while letting Google or another provider handle mail. When configuring SPF and DMARC, follow that mail provider's documentation rather than the web host's.