by GelFuzion
Home / Domain & Security / DNS Lookup
06.01Domain & Security

DNS Lookup

Query A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records over encrypted DNS, then check whether Google and Cloudflare agree on what your domain points to.

Updated
Mode

Enter a domain to see its records. Try github.com or 1.1.1.1.

What each DNS record does

DNS is the phone book that turns a name like example.com into the addresses and settings the rest of the internet needs. Every record has a type, a value, and a TTL (time to live, in seconds) that tells resolvers how long they may cache the answer before asking again.

  • A / AAAA: the IPv4 and IPv6 addresses of the server. This is what your browser ultimately connects to.
  • CNAME: an alias. www often points at the apex domain or at a host like a CDN. A name with a CNAME cannot hold other records, which is why most providers do not allow a CNAME on the root domain.
  • MX: where email for the domain is delivered. Lower priority numbers are tried first. The tool sorts them for you.
  • NS: which nameservers are authoritative. If these do not match the provider where you are editing records, your edits have no effect.
  • TXT: free-form text used for SPF, DMARC, DKIM and domain ownership proofs from Google, Microsoft, Stripe and others.
  • SOA: the zone's start of authority: primary nameserver, admin contact, serial number and negative-cache timer.
  • CAA: which certificate authorities may issue SSL certificates for the domain. No CAA record means any CA can.
  • PTR: reverse DNS, mapping an IP back to a hostname. Mail servers check it, so it matters if you send email from your own IP.

How this lookup works

Your browser cannot send raw DNS packets, so the tool uses DNS-over-HTTPS (DoH). Google Public DNS and Cloudflare both expose a JSON endpoint that answers ordinary HTTPS requests, and both allow cross-origin calls. Nothing goes through our servers. You can reproduce any result from a terminal:

curl "https://dns.google/resolve?name=example.com&type=MX"

curl -H "accept: application/dns-json" \
  "https://cloudflare-dns.com/dns-query?name=example.com&type=TXT"

The response includes a Status code. 0 is NOERROR, 3 is NXDOMAIN (the name does not exist), and 2 is SERVFAIL, which usually means broken DNSSEC or nameservers that are not responding. A NOERROR answer with no records simply means the name exists but has nothing of that type.

Comparing resolvers after a DNS change

When you move hosting or switch email providers, the old records stay cached for up to their TTL. Compare mode asks Google and Cloudflare for the same record and marks each type as a match or a mismatch. If one side still shows the old IP, you are waiting on cache expiry, not a misconfiguration. Lower the TTL to 300 a day before a planned migration and the switchover becomes nearly instant.

Be aware of what this is not. Two resolvers are a useful sanity check, but true global propagation testing needs probes in many countries querying local ISP resolvers, and a browser tool cannot do that. Also, CDNs like Cloudflare, Fastly and AWS deliberately return different IPs depending on where the query comes from, so A record mismatches for large sites are normal.

Common problems this reveals

  • Edits not taking effect: check NS first. If the nameservers point at your registrar but you edited records at your host, nothing will change.
  • Email bouncing: look for missing MX records, or MX hosts that themselves fail to resolve.
  • Two SPF records: a domain may only have one TXT starting with v=spf1. The tool flags SPF and DMARC records and links to the SPF / DMARC checker for a full audit.
  • SSL issuance failing: a CAA record that does not list your certificate authority (for example letsencrypt.org) will block renewals.

Frequently asked questions

Why do Google and Cloudflare show different answers?

Each resolver caches records for the TTL it received. If you changed a record recently, one resolver may still hold the old value until its cached copy expires. Geo-routed services and CDNs also hand out different IPs on purpose, so a mismatch on A or AAAA records is not always a problem.

Is this a full DNS propagation checker?

No. It compares two large public resolvers, which catches most stale-cache situations. A true global propagation check needs servers in many regions querying local ISP resolvers, which a browser cannot do on its own.

Why does the ANY or All lookup not show every record?

Most resolvers no longer answer real ANY queries (RFC 8482), so this tool runs one query per common record type instead. It cannot list arbitrary subdomains or SRV records, because DNS has no way to enumerate names you do not already know.

How do I look up reverse DNS for an IP address?

Type the IP address into the box. The tool builds the in-addr.arpa (IPv4) or ip6.arpa (IPv6) name for you and queries its PTR record.