DNS Lookup Tool
Resolve A, AAAA, MX, TXT, NS, CNAME, SOA, and CAA records over DoH. Useful for verification, debugging, and security checks.
Recommended for this workflow
Curated tools we trust. Some links are sponsored — see our advertising disclosure.
How to read the results
Safe
No issues detected across the checks we ran. You can typically proceed normally.
Warning
Something looks off. Verify additional details before sharing data or making payments.
Flagged
Strong signals of risk. Avoid interacting until the issue is investigated and resolved.
What this tool does
DNS is the address book of the internet. The records on a domain reveal where mail goes (MX), who can issue certificates (CAA), how email is authenticated (TXT/SPF/DMARC), and more.
When to use it
- Diagnosing why a site or email isn't reachable
- Verifying DNS-based ownership for a service
- Confirming SPF, DKIM, and DMARC posture
- Checking nameserver migrations
Monitor DNS for changes
Catch unauthorized record changes the moment they happen.
Continuous monitoring keeps results accurate over time. Track multiple domains and get alerts on changes.
Related verification steps
Key terms, defined
- DNS
- Domain Name System. Hierarchical, distributed database that translates names to addresses and other resource records.
- A / AAAA record
- Forward address records mapping a hostname to an IPv4 (A) or IPv6 (AAAA) address.
- MX record
- Mail exchanger record listing the priority-ordered hostnames that accept email for a domain.
- TXT record
- Free-form text record. Used for SPF, DKIM, DMARC, domain ownership verification, and ad-hoc metadata.
- CNAME
- Canonical name record. Aliases one hostname to another. Cannot coexist with other records at the same name.
- NS record
- Nameserver record. Identifies the authoritative DNS servers that publish a zone's records.
- SOA record
- Start of Authority. Zone-level metadata: primary nameserver, contact email, serial number, and refresh timers.
- CAA record
- Certification Authority Authorization. Whitelists the CAs allowed to issue TLS certificates for the domain.
- DoH / DoT
- DNS-over-HTTPS and DNS-over-TLS. Encrypted transports that prevent eavesdropping and tampering on DNS queries.
- TTL
- Time to Live. Number of seconds a record may be cached by recursive resolvers before being re-fetched.
- DNSSEC
- DNS Security Extensions. Public-key signatures on zone data, validated by resolvers to detect tampering.
Frequently asked questions
DNS record types, encrypted transports, and the email authentication stack — the networking vocabulary that resolvers, mail servers, and certificate authorities depend on.
What is a DNS lookup?+
A DNS lookup queries the global Domain Name System to translate a human-readable domain (example.com) into the data needed to reach it: IP addresses (A/AAAA), mail servers (MX), authentication policies (TXT), and more. The result is what every browser, mail server, and security tool actually acts on.
What is DNS-over-HTTPS (DoH)?+
DNS-over-HTTPS encrypts DNS queries inside standard HTTPS traffic, preventing ISPs and network observers from seeing or modifying lookups. This tool resolves through Cloudflare's DoH endpoint (1.1.1.1), which provides authoritative, tamper-resistant answers.
What is the difference between A, AAAA, CNAME, MX, TXT, NS, SOA, and CAA records?+
A maps a hostname to an IPv4 address; AAAA to IPv6. CNAME aliases one hostname to another. MX lists mail servers and their priority. TXT carries arbitrary text — used for SPF, DKIM, DMARC, and domain verification. NS lists authoritative nameservers. SOA holds zone metadata (serial, refresh, expire). CAA restricts which certificate authorities may issue TLS certificates for the domain.
Why do my DNS records look different from another tool's?+
DNS is cached at many layers — recursive resolvers, ISPs, browsers — each with its own TTL. Recent changes propagate gradually. A direct DoH query (like this tool) sees what the authoritative server currently publishes; cached resolvers may still serve stale data for minutes to hours.
What is DNSSEC?+
DNSSEC (DNS Security Extensions) cryptographically signs DNS records so resolvers can verify the answers were not forged or modified in transit. Without DNSSEC, on-path attackers can poison resolver caches and silently redirect users.
What is SPF, DKIM, and DMARC?+
SPF (TXT record) lists which IPs may send mail for a domain. DKIM (TXT record) publishes the public key used to verify cryptographic signatures on outbound messages. DMARC (TXT record at _dmarc.domain) tells receivers how to handle SPF/DKIM failures and where to send aggregate reports. All three should be present and aligned for production email.