DNS lookup
Every record for a name, straight from its authoritative nameservers or from a public resolver, with plain-English notes.
Working on it…
Running the checks. Results appear here in a moment.
What this tool checks
Enter a domain or host name and choose a record type. By default the tool resolves the name itself: it starts at the root servers, follows the delegation down to the domain's own (authoritative) nameservers and asks them, so you see what they publish right now rather than a copy from someone's cache. It names the server that answered.
You can also pick a public resolver instead (Cloudflare, Google or Quad9, asked over DNS-over-HTTPS, RFC 8484) to see what their users get. Those three validate DNSSEC, so a broken signature shows up there as an error; our own resolver does not check signatures (use the DNSSEC check for that).
With All common types selected, the tool asks for A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in one go. SRV, PTR, HTTPS, TLSA, DS and DNSKEY can be chosen on their own:
- for SRV, enter the full service name, such as
_sip._tcp.example.com; - for PTR (reverse DNS), enter the reverse name, such as
10.2.0.192.in-addr.arpafor 192.0.2.10.
What it can't see: other people's resolvers may still hold an older answer until its TTL runs out; the DNS propagation check compares many of them. Our resolver keeps answers for at most five minutes. It also can't list every name in a zone: DNS has no "list all" query.
For the reverse direction, from an IP address to its name, use the reverse DNS check.
Reading the results
The Records table shows one row per record:
| Column | Meaning |
|---|---|
| Type | The record type, such as A, MX or TXT. |
| Name | The name the record belongs to. If the name is an alias, you will see the CNAME and then the records of its target. |
| TTL | How many seconds resolvers may keep the answer cached. From the authoritative servers this is the full TTL; from a public resolver it is the time left, so it counts down between lookups. |
| Value | The record data: an address, priority host for MX, the quoted strings of a TXT record, and so on. |
The line above the table shows which resolver was used, the response code and how long it took; with our resolver, the nameserver that answered is named below it. The response code matters:
- NOERROR with records: the lookup worked.
- NOERROR with no records: the name exists, but has nothing of the type you asked for.
- NXDOMAIN: the name does not exist at all.
- SERVFAIL: no usable answer: the domain's nameservers don't respond or don't answer for it, or (from a public resolver) a DNSSEC signature is broken.
With all types selected, the tool adds a few notes: whether the name has an IPv6 (AAAA) record alongside its IPv4 one, and, at the top of a zone (where NS records are), whether there is a CAA record.
Common problems and fixes
NXDOMAIN for a domain you own
Check the spelling, then that the domain is registered, not expired, and delegated to the right nameservers: the WHOIS / RDAP lookup shows the nameservers set at the registrar. Records added at a DNS host the domain doesn't use are never seen.
SERVFAIL
If our resolver fails too, the nameservers are the problem: the nameserver health check tests each one. If only the public resolvers fail, the cause is usually DNSSEC: the DS record at the registrar no longer matches the zone's keys, often after moving DNS hosts. Run the DNSSEC check to confirm.
No IPv6 (AAAA) record
Visitors on IPv6-only networks then reach you through NAT64, if at all. Most hosts and CDNs provide an IPv6 address; add it next to the A record:
www.example.com. 3600 IN A 192.0.2.10
www.example.com. 3600 IN AAAA 2001:db8::10
No CAA record
Without CAA, any certificate authority may issue certificates for the domain. A CAA record limits that to the ones you use:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
Check which CA issued your current certificate with the SSL/TLS certificate check first, so renewals keep working.
A CNAME at the zone apex
A CNAME cannot sit alongside other records, so it cannot be used on the bare domain (example.com), which always has SOA and NS records. Use A/AAAA records there, or your DNS host's ALIAS/flattening feature.
FAQ
What is the difference between NXDOMAIN and no records?
NXDOMAIN means the name doesn't exist at all. NOERROR with no records means the name exists (it has some other record type, or names below it) but has nothing of the type you asked for.
Why do different resolvers show different answers?
Each resolver caches answers for the TTL, so after a change some still serve the old value until it expires. Some services also answer differently depending on where the question comes from, such as CDNs and geo-routing. Our own resolver asks your nameservers directly, so it shows the current value; the DNS propagation check compares 15 public resolvers at once.
How do I check reverse DNS (PTR) for an IP address?
Choose PTR and enter the reverse name: reverse the four parts of an IPv4 address and add in-addr.arpa, so 192.0.2.10 becomes 10.2.0.192.in-addr.arpa. Reverse DNS is set by whoever controls the IP range, usually your hosting provider.
What does the TTL number mean?
The seconds a resolver may cache the record. With a TTL of 3600, resolvers holding the old answer may take up to an hour to see a change.
How do I check my SPF or DMARC record?
Look up the TXT records of the domain for SPF, or of _dmarc.example.com for DMARC. The email security check reads and grades all the mail records at once.