Server & Network
DNS Lookup
Query all important DNS records of a domain – A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and more. With checks for SPF, DMARC and DKIM, DNSSEC status, reverse lookup for IP addresses and a comparison between three public resolvers.
- Processed on the server – Privacy
- No sign-up
- Free
Look up DNS
An IP address starts the reverse lookup (PTR). “Common” queries A, AAAA, CNAME, MX, NS, TXT, SOA and CAA, plus DMARC.
Records
Check
Email security
Guide
How it works
- Enter a domain
Enter a domain, e.g. example.com or mail.example.com – a full address or an email address works too. An IP address starts the reverse lookup (PTR).
- Choose types
“Common” queries A, AAAA, CNAME, MX, NS, TXT, SOA and CAA. Individual types such as SRV, DS or DNSKEY can be clicked in addition. For DKIM, enter the selector – it is in the header of a sent email (s=…).
- Read the result
Each record is shown with its TTL – that is how long resolvers cache it. On the right, the tool checks name servers, IPv6, DNSSEC, CAA as well as SPF, DMARC and DKIM for sending email.
- Compare
After a change, “Compare” shows whether Cloudflare, Google and Quad9 already return the new values. Differences disappear at the latest when the old TTL has expired.
FAQ
Frequently asked questions
How long does it take for a DNS change to propagate everywhere?
As long as the TTL of the old record – resolvers may cache it until then. If it says 1 day, it can take up to a day. Tip: lower the TTL to 5 minutes a few days before a planned change.
What are SPF, DKIM and DMARC?
Three TXT records against forged senders: SPF lists the servers allowed to send mail for the domain. DKIM contains a key used to sign mail. DMARC defines what happens to mail that fails both – and where reports go. Gmail and Yahoo require them for bulk senders.
What does “DNSSEC validated” mean?
The domain’s records are cryptographically signed, and the resolver has verified the signatures. Forged DNS responses are then detected. If a resolver returns SERVFAIL, DNSSEC is often misconfigured.
Why do resolvers return different answers?
Usually because of caching after a change. Large websites and CDNs also serve different IP addresses depending on location – that is intentional.
Can I also query subdomains and SRV records?
Yes. Enter the full name, e.g. _sip._tcp.example.com for SRV or selector._domainkey.example.com for a DKIM key, and choose the matching type.
Which resolvers are used?
Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9) – queried in encrypted form via DNS over HTTPS from my server. They do not learn your own IP address.