DNS Lookup

How to use the DNS Lookup#

1. Enter a domain name, for example example.com.
2. Run the lookup. All supported record types are queried at once.
3. Scan the record groups for missing or unexpected values, starting with the records related to your task: A and AAAA for a website, MX for email, TXT for verification and email authentication.
4. Check the SPF and DMARC panel if you are troubleshooting email delivery.
5. Note the TTL of any record you plan to change, since it tells you how long the old value may stay cached.

Understanding your results#

Every record is shown with its value and its TTL (time to live), measured in seconds. The TTL is how long resolvers are allowed to cache the answer before asking again.

A and AAAA. The IPv4 (A) and IPv6 (AAAA) addresses a hostname points to. If your website is on a new server but these records still show the old address, visitors are being sent to the old server.

CNAME. An alias that points one name to another name. A CNAME cannot sit alongside other records at the same name, which is why the root of a domain (example.com) normally uses A or AAAA records rather than a CNAME.

MX. The mail servers that receive email for the domain, each with a priority number. Lower numbers are tried first. No MX records usually means the domain cannot receive email.

NS. The nameservers that are authoritative for the domain. These should match the nameservers set at the registry, which you can see in the WHOIS Lookup.

TXT. Free-text records used for domain verification (search engines, email services, certificate authorities) and for email authentication.

SOA. The start-of-authority record: the primary nameserver, the administrator contact, a serial number that changes when the zone is edited, and timers that control how secondary nameservers refresh. The final value is the TTL used for caching negative answers.

CAA. Lists which certificate authorities may issue SSL/TLS certificates for the domain, as defined in RFC 8659. If no CAA record exists, any publicly trusted authority may issue. If one exists and your certificate provider is not listed, renewals can fail.

SPF and DMARC#

SPF lives in a TXT record that begins with v=spf1 and lists the servers allowed to send mail for the domain. Under RFC 7208, a domain must not publish more than one SPF record, and evaluation is limited to 10 DNS-querying terms. Two SPF records, or too many include: entries, are common causes of failed authentication.

DMARC is a TXT record published at _dmarc.yourdomain. Its p= tag tells receiving servers what to do with mail that fails authentication: none (monitor only), quarantine or reject. The rua= tag, if present, is where aggregate reports are sent.

We highlight both when they are present, so you can see at a glance whether a domain has email authentication in place.

How this tool works#

When you run a lookup, our server asks its DNS resolver for each record type and displays the answers exactly as returned, including TTLs. For DMARC we query the TXT record at the _dmarc subdomain, and we pick out the SPF record from the domain's TXT records.

This is a single vantage point. You see what one resolver sees right now, not a worldwide propagation map. If you changed a record recently, other resolvers around the world may still serve the old value until its TTL expires, and some internet providers cache longer than they should.

Our own results are cached for 10 minutes. If you have just edited a record, wait a few minutes before checking again.

For a full explanation of each record type and when to use it, read our guide to DNS records explained.

Tips#

• Before migrating a site or email, lower the TTL on the records you will change a day or so in advance, so the switch spreads faster.
• Keep exactly one SPF record. Merge services into it instead of adding a second v=spf1 record.
• Start DMARC with p=none and a report address, review the reports, then move to quarantine or reject once legitimate mail passes.
• If you use CAA, add every certificate authority you rely on, including the one your hosting provider or CDN uses.
• Compare the NS records here with the registry nameservers when a site stops resolving after a DNS provider change.
• After fixing A or AAAA records, confirm the certificate on the new server with the SSL Checker.

Frequently asked questions#

Why doesn't my DNS change show up yet?#

Resolvers cache records for the length of their TTL, so an old value can persist until that time runs out. Our results are also cached for 10 minutes. Check the TTL of the record you changed to estimate how long to wait.

Is this a DNS propagation checker?#

No. It queries from one resolver and shows what that resolver returns now. It cannot tell you what resolvers in other countries or networks are returning, which is what a propagation map shows.

Why can't I use a CNAME on my root domain?#

A CNAME cannot exist alongside other record types at the same name, and the root of a domain always has NS and SOA records. That is why the root normally uses A and AAAA records. Some DNS providers offer their own workaround for this.

What does TTL mean?#

TTL, or time to live, is the number of seconds a resolver may cache a record before asking again. Short TTLs make changes spread faster; long TTLs reduce lookups and can slightly speed up repeat visits.

Why is having two SPF records a problem?#

RFC 7208 says a domain must not have multiple SPF records. When two exist, receiving servers cannot choose between them, and SPF checks can fail. Combine all senders into a single record.

Do I need a CAA record?#

It is optional. A CAA record limits which certificate authorities may issue certificates for your domain, which reduces the risk of unauthorized issuance. If you add one, make sure it includes every authority you actually use.