About this tool
DNS (the Domain Name System) turns names like example.com into the information computers need: IP addresses, mail servers, verification strings and more. This tool asks a public recursive resolver for the records you choose and shows exactly what it returned.
Queries are sent directly to the resolver you pick. If a name is an alias, the CNAME chain the resolver followed is shown above the records.
How to read the results
- A / AAAA
- The IPv4 / IPv6 addresses the name points to — where browsers connect.
- MX
- Mail servers for the domain. Lower preference numbers are tried first.
- TXT
- Free-form text. Used for SPF (
v=spf1), domain verification tokens (Google, Microsoft, etc.) and other policies. DMARC and DKIM live on special sub-names (_dmarc,selector._domainkey). - CNAME
- An alias: the name is another name for the target. A name with a CNAME cannot have other records.
- NS
- The authoritative name servers that host the domain's zone — usually your DNS provider.
- SOA
- Start of Authority: the primary name server, the administrator's address (first dot = @), the zone serial number and timers used by secondary servers and for negative caching.
- CAA
- Which certificate authorities may issue TLS certificates for the domain. No CAA record means any CA may.
- TTL
- Time to live: how long resolvers may cache the answer. The value shown is what remains in the resolver's cache, so it counts down between lookups.
"No records" means the name exists but has no record of that type (NOERROR/NODATA). "Domain does not exist" means the resolver answered NXDOMAIN. A failed lookup (timeout or SERVFAIL) tells you nothing about the records — try again or switch resolver.
Limitations
- Results come from one public resolver and may be cached. Recently changed records can differ between resolvers until the old TTL expires — use the DNS propagation checker to compare.
- Resolvers in different regions can return different answers for geo-routed services (CDNs). This tool queries from one server location.
- Only the eight common record types are supported. DNSSEC status is shown only as the resolver's "authenticated data" flag.
Frequently asked questions
What is the difference between this and nslookup or dig?
It performs the same kind of query as dig example.com MX @1.1.1.1, then explains the answer. Command-line tools use your own network's resolver, which may have different cached data.
Why does the TTL change every time I look?
Recursive resolvers count the TTL down while the answer is cached. The TTL configured in your zone is the maximum you will see, right after the cache is refreshed.
Why do I see an IP address different from what I configured?
Either the change has not reached this resolver yet (wait for the old TTL to expire), or the name uses a CDN or proxy (such as Cloudflare's orange-cloud mode) that answers with its own addresses.
Can I look up a subdomain or a special name like _dmarc?
Yes. Enter the full name, for example _dmarc.example.com or selector1._domainkey.example.com, and choose TXT.
Is the DNS lookup free?
Yes, with a fair-use limit per network.
Which record should I check for a website?
A and AAAA (addresses) or CNAME (alias).
Which record controls e-mail?
MX, plus TXT records for SPF and DMARC.
What does TTL mean?
How many seconds resolvers may cache the answer.