DNS lookup tool.
Look up any DNS record for a domain and see exactly what a public resolver returns: records, TTLs, response codes and how long each query took. Switch resolvers to check propagation or find a stale cache.
Queried example.com via Cloudflare 1.1.1.1 JSON · text
A NOERROR 9.6ms · udp
| Name | TTL | Type | Value |
|---|---|---|---|
| example.com. | 116 | A | 104.20.23.154 |
| example.com. | 116 | A | 172.66.147.243 |
About this tool
Each record type is a real DNS query sent from this server over UDP (falling back to TCP on truncation) to the resolver you pick, with EDNS enabled. Nothing is cached here, so what you see is what that resolver is serving right now. Enter an IP address and it becomes a PTR (reverse DNS) lookup automatically.
How to do a DNS lookup
- Type the domain name (or an IP address for reverse DNS).
- Tick the record types you care about. A, AAAA, CNAME, MX, NS and TXT are on by default.
- Pick a resolver. Cloudflare (1.1.1.1) is the default; switch to Google or Quad9 to compare answers, or enter your own resolver's IP.
- Press Look up. Each type is queried separately so you can see its own response code, TTL and timing.
DNS record types you can look up
| Record | What it tells you |
|---|---|
| A | The IPv4 address(es) a name points to. |
| AAAA | The IPv6 address(es). Missing AAAA is why a site is unreachable on some mobile networks. |
| CNAME | An alias to another name. The resolver follows the chain; the tool shows every link. |
| MX | Mail servers and their preference. Lowest number is tried first. |
| NS | The authoritative nameservers for the zone. Wrong NS after a registrar move is a classic outage. |
| TXT | Free text: SPF (v=spf1), DMARC at _dmarc., DKIM under a selector, domain verification tokens. |
| SOA | Zone authority: primary nameserver, admin contact, serial number and refresh timers. The serial tells you whether secondaries have caught up. |
| CAA | Which certificate authorities may issue for the name. An unexpected CAA record blocks Let's Encrypt renewals. |
| SRV | Service discovery (host, port, priority, weight) for things like SIP, XMPP and Minecraft. |
| PTR | Reverse DNS: the name an IP address maps back to. Mail servers without a matching PTR get rejected. |
Check DNS propagation
"Propagation" is really cache expiry. When you change a record, every resolver in the world keeps serving its old copy until the TTL it cached runs out. Run the same lookup against Cloudflare, Google and Quad9: if they disagree, the change has not reached them all yet, and the TTL column tells you how long each one will hold on. The authoritative answer (query the zone's NS directly by entering its IP as the resolver) is what they will all converge on. There is more on this in how long DNS propagation takes.
Common DNS lookup problems
- NXDOMAIN: the name does not exist at all. Usually a typo, a record that was never created, or the wrong zone. See NXDOMAIN vs SERVFAIL.
- SERVFAIL: the resolver could not get an answer. The authoritative servers are down or unreachable, or DNSSEC validation failed. Try another resolver: if one fails and another works, suspect DNSSEC.
- NOERROR with no records: the name exists but has no record of that type. Common when asking for AAAA on an IPv4-only host, or for MX on a subdomain.
- Stale record: one resolver still returns the old value. Check the TTL and wait, or flush your own resolver if it is the one lagging.
- Very long TTL: 86400 (a day) or more means a change will take that long to be seen everywhere. Lower it a day or two before a migration.
- CNAME at the apex: not allowed by the standard; many providers offer ALIAS or ANAME flattening instead, which shows up here as plain A records.
Examples
- example.com A and AAAA: addresses
- example.com MX: mail servers
- _dmarc.example.com TXT: DMARC policy
- example.com NS and SOA: who is authoritative
- 1.1.1.1: reverse DNS (PTR)
DNS lookup from the command line
Everything here works from a terminal too. Plain text is the default for curl: curl "kirkdiamond.com/tools/dns?name=example.com&type=MX&type=TXT". Add &format=json for structured output and &resolver=8.8.8.8 to pick the resolver. Only public names and resolvers can be queried, and nothing is stored.