What this lookup does
DNS turns names people can remember into the addresses computers route to. This tool asks a public resolver for a domain's records and shows you exactly what came back.
Queries go from your browser to a public resolver over DNS-over-HTTPS, first Google Public DNS and then Cloudflare if the first does not answer. Resolvers cache answers for as long as each record's TTL allows, so a record you changed minutes ago can still show its old value until the TTL runs out.
Record types
| Type | Holds | You check it when |
|---|---|---|
| A | The IPv4 address of the name | A site has moved to a new server |
| AAAA | The IPv6 address of the name | Confirming a site is reachable over IPv6 |
| CNAME | An alias pointing to another name | Connecting a subdomain to a hosted service |
| MX | Mail servers, in priority order | Email is bouncing or you switched mail provider |
| NS | The authoritative name servers | You changed DNS host or registrar |
| TXT | Free text: SPF, DKIM, DMARC, site verification | Setting up email authentication or proving domain ownership |
| SOA | Zone serial number and timers | Checking whether a zone update has propagated |
| CAA | Which certificate authorities may issue for the domain | A TLS certificate request was refused |
Reading the result
- TTL is how long resolvers may cache the record. A low value at a public resolver means the cached copy is about to expire, not that your TTL is low.
- NXDOMAIN means the name does not exist at all. An empty answer with NOERROR means the name exists but has no record of that type.
- DNSSEC validated means the resolver verified a signature chain for the answer. Most domains are not signed, and that is not an error.