Free tool · DNS
DNS lookup
Every record, live.
Query A, AAAA, CNAME, MX, NS, TXT, CAA and SOA records for any domain through public resolvers, with TTLs and the email records labelled.
FreeNo sign-upNothing stored
Result
Results appear here
Enter a domain above and pick a record type. The records, their TTLs and what they are for are listed here.
02Guide
How to use the DNS lookup
Enter a domain or any name below it, pick a record type and press Look up. The query goes to two large public resolvers, Cloudflare's 1.1.1.1 and Quad9's 9.9.9.9, so the answer is what the rest of the internet sees, not what your own network or a local hosts file says. Use the buttons under the result to query another type for the same name without retyping it.
Service names with underscores work too, which is how mail and verification records are published: _dmarc.example.com for DMARC, selector._domainkey.example.com for DKIM, _mta-sts.example.com for MTA-STS.
DNS record types explained
| Type | What it holds | Typical use |
|---|---|---|
| A | An IPv4 address | Where a website or service lives |
| AAAA | An IPv6 address | The same, over IPv6 |
| CNAME | An alias to another name | www pointing to a CDN or platform host name |
| MX | Mail servers with a priority | Where email for the domain is delivered; lowest number first |
| NS | The authoritative nameservers | Who answers for the zone; set at the registrar |
| TXT | Free text | SPF, DMARC, DKIM keys, domain verification |
| CAA | Allowed certificate authorities | Which CAs may issue certificates for the domain |
| SOA | Zone metadata | Primary nameserver, serial and timers, negative cache TTL |
Checking email records: SPF, DKIM and DMARC
Email authentication lives in DNS. The SPF record is a TXT record on the domain itself that starts with v=spf1 and lists the servers allowed to send for it; a domain may have only one. DKIM public keys are TXT records at selector._domainkey under the domain, where the selector comes from the DKIM-Signature header of a sent message. DMARC is a TXT record at _dmarc that starts with v=DMARC1 and tells receivers what to do with mail that fails both checks (p=none, quarantine or reject) and where to send reports.
The TXT result marks SPF, DMARC, DKIM and verification records so they are easy to find among the rest. MX records show where the domain receives mail; a domain that sends but never receives should still publish an SPF record, and many add a "null MX" (priority 0, server .) to say it accepts no mail.
TTL and "DNS propagation"
There is no propagation in the sense of a change slowly spreading. Each resolver caches an answer for the record's time to live (TTL) and asks again when it runs out. A change becomes visible everywhere once every cache that held the old answer has expired, so the old TTL is the delay to plan for. Lower the TTL to a few minutes a day before a migration, make the change, then raise it again. Missing names are cached too, for the negative TTL in the SOA record.
The TTL shown for A and AAAA records counts down: it is the time left in the resolver's cache, not necessarily the value configured in the zone.
CAA records
A CAA record names the certificate authorities allowed to issue certificates for a domain, for example 0 issue "letsencrypt.org". Every public CA must check it before issuing, so it blocks mis-issuance by any CA you have not listed. issuewild covers wildcard certificates separately, and iodef gives an address for violation reports. No CAA record means any CA may issue. Once the certificate exists, check it with the SSL/TLS checker.
When a lookup fails
- NXDOMAIN: the name does not exist at all. Check the spelling, and whether the domain has expired at the registrar.
- No records of this type: the name exists, it just has none of that type. A domain without AAAA records is simply not on IPv6.
- SERVFAIL: the domain's nameservers did not give a usable answer, most often because of broken DNSSEC signatures or a delegation to nameservers that do not serve the zone.
- No CNAME on the bare domain: a CNAME cannot sit next to the SOA and NS records at the zone apex, so providers offer flattening (ALIAS or ANAME) that returns A and AAAA records instead.
DNS and DDoS
DNS is also one of the most abused protocols in denial-of-service attacks. Small spoofed queries to misconfigured open resolvers return answers many times larger, aimed at a victim's address. Read how DNS amplification works, and why a recursive resolver should only answer the networks it serves.
04More free tools
Check the rest of the stack.
Subnet calculator
Network, broadcast, host range and netmask for any IPv4 CIDR block, with a /8 to /32 reference table.IP & ASN lookup
Which network (ASN), organisation and country an IPv4 or IPv6 address belongs to, starting with yours.Bandwidth to PPS calculator
Bit rate to packets per second and back for any frame size, with line-rate overhead and a 95th percentile calculator.Tunnel MTU & MSS calculator
Stack GRE, WireGuard, VXLAN, IPIP, PPPoE or IPsec and get the tunnel MTU, both MSS values and ready-to-paste clamp rules.Get started
Put a WAF, CDN and unmetered DDoS protection
in front of your site.
Point your DNS at GuardX and traffic is filtered at the edge before it reaches your server. Flat pricing, no surcharge while an attack runs.
