DNS Lookup

What DNS is and why lookups matter

The Domain Name System (DNS) is the internet’s phone book. Humans remember names like mail.example.com, but routers need numeric addresses. DNS translates those names into IPv4 (A), IPv6 (AAAA), mail routes (MX), name-server delegations (NS), and many other record types. Every time you open a website, send email, or validate a TLS certificate, some resolver somewhere is asking DNS questions on your behalf.

A DNS lookup is simply a question: “What data is published for this name and record type?” Authoritative name servers hold the truth for a zone; recursive resolvers (your ISP, Google Public DNS, Cloudflare, and others) cache answers and chase referrals until they find an authoritative response. This tool does not speak to your laptop’s resolver directly. Instead, it uses DNS-over-HTTPS (DoH) from our API to Google or Cloudflare’s public resolver APIs, then shows you the JSON-shaped answer in a readable table.

Record types you can query here

• A / AAAA — IPv4 and IPv6 addresses for a hostname.
• CNAME — an alias pointing to another name (not allowed at zone apex on many providers).
• MX — mail exchangers with preference values; lower numbers are tried first.
• NS — which servers are authoritative for the zone.
• TXT — arbitrary text; often SPF, DKIM, DMARC, or verification tokens.
• SOA — start of authority: serial, refresh timers, and the primary master name.
• CAA — which certificate authorities may issue certs for the domain.
• SRV — service location (host, port, priority, weight).
• PTR — reverse DNS from an IP to a hostname (via in-addr.arpa).
• DS / DNSKEY — DNSSEC delegation and key material when published.

Choosing ALL fires parallel lookups for the most common set (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA) so you can skim a domain’s baseline configuration quickly.

How to use this DNS lookup tool

Enter a hostname (apex or subdomain) and tap a record type chip. Click Lookup. If you paste an IPv4 or IPv6 address, the tool switches to PTR automatically and asks for reverse DNS. Use Compare both when you are debugging a change: Google and Cloudflare may still have different cached answers for a few minutes after you edit DNS at your registrar.

For email authentication, query TXT on the apex domain — strings starting with v=spf1 are highlighted as SPF. Use the Check DMARC button to query _dmarc.yourdomain without typing the underscore prefix yourself. Copy individual cells or the full JSON for tickets and runbooks.

Reading results: status, TTL, and AD

The DNS Status code follows the usual response codes: NOERROR (0) means the name exists for that query type (possibly with an empty answer section if no records). NXDOMAIN (3) means the name does not exist. SERVFAIL often indicates a lame delegation or resolver trouble upstream.

TTL (time to live) is shown in human-readable form (seconds, minutes, hours, or days). It tells resolvers how long they may cache that RRset. After you change DNS, you wait at least the old TTL before most of the world sees the new value. AD (authentic data) appears when the resolver believes DNSSEC validated the chain; absence of AD does not by itself mean the answer is wrong — many zones are unsigned.

elapsed_ms is round-trip time from our server to the DoH API, not your home network latency. Use it to spot slow or failing resolver paths, not as a global performance benchmark.

Propagation, caching, and honesty about DoH

People often ask whether DNS has “propagated.” In practice, there is no single global instant switch. Each recursive resolver caches independently according to TTL and its own policies. Comparing two large public resolvers helps, but it is not a worldwide propagation map. A corporate resolver in another country may still show the previous A record until its cache expires.

DoH encrypts the query between our infrastructure and Google or Cloudflare, which protects the name from casual eavesdropping on that hop. The resolver you choose still sees the qname and qtype. If you need local resolver behavior (split DNS, internal zones), use your OS tools (dig, nslookup, or your router’s DNS) instead of this page.

Privacy and responsible use

Lookups run through our API so we can apply rate limits and protect the site from abuse. That means domain names you enter are processed on our servers and forwarded to Google or Cloudflare DoH. Do not use this tool to enumerate private internal names you would not want a third-party resolver to learn. For sensitive investigations, run queries from your own controlled resolver.

DNSSEC, AD flag, and DS records

When operators enable DNSSEC, resolvers validate signatures along the chain from the root to your zone. The AD (authentic data) bit in a response indicates the resolver considered the answer validated. Unsigned zones are still normal — most of the web runs without DNSSEC today. Querying DS or DNSKEY helps you confirm delegations and keys during a migration. This tool shows what the public resolver returns; it does not replace a full DNSSEC debugger with trace mode and wire-format inspection.

If you are publishing new records, remember that DNS is authoritative at the zone cut: parent NS and child NS must agree. A common mistake is editing DNS at the registrar while the domain still delegates to an old DNS host — lookups show stale NS until you fix delegation.

Troubleshooting common issues

• NXDOMAIN — typo, unregistered domain, or wrong subdomain; confirm the zone exists at your registrar.
• Empty answer with NOERROR — name exists but that record type is not published (common for AAAA on IPv4-only hosts).
• CNAME at apex — many DNS providers forbid CNAME on the bare domain; use ALIAS/ANAME or A records instead.
• Long TTL — after fixes, lower TTLs before the change window next time.
• Compare mismatch — wait for TTL, or flush is impossible on public resolvers; just wait or test from another resolver.
• Rate limit — too many queries in a minute; wait and retry.

Last updated: October 2026