Online DNS lookup for every common record type
This DNS lookup tool shows the records behind any domain name: A and AAAA addresses, CNAME aliases, MX mail servers, TXT records such as SPF and DMARC, NS name servers, the SOA zone record, CAA certificate rules, SRV service records and reverse PTR lookups from an IP address. Each answer shows its TTL and whether the response was DNSSEC-validated.
It works like dig or nslookup without a terminal: queries go over DNS-over-HTTPS to Google Public DNS, so you see what a public resolver sees, not what your office network or ISP cache says. That makes it ideal for checking that a record change has gone live, debugging a website that will not load, verifying a new mail provider, or auditing a domain’s email security.
How to use the DNS Lookup
- Enter a domain such as example.com — or an IP address to run a reverse (PTR) lookup.
- Choose a record type, keep “All common records” to query eight types at once, or pick “Email setup” to check MX, SPF, DMARC and DKIM together.
- Press “Look up”. Each record shows its value, TTL and the response status (NOERROR, NXDOMAIN, SERVFAIL).
- Read the hints under SPF, DMARC and DKIM records to spot weak or missing email protection.
- Use “Copy results” for a plain-text report, and reopen earlier checks from “Recent queries”.
DNS Lookup features
Every common record type
A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, PTR, DNSKEY and DS, with MX priorities, SRV ports and SOA timers decoded.
Parallel “all records” mode
Eight record types are queried at the same time, so a full picture of a domain takes about a second.
Email security check
One click finds MX servers, the SPF record, the DMARC policy and DKIM keys under common selectors, and explains what each means.
Status codes explained
NXDOMAIN, SERVFAIL and REFUSED are translated into plain language, with a tip when a subdomain is missing but the parent exists.
TTL and DNSSEC
See how long each answer may be cached and whether Google Public DNS validated the DNSSEC chain (the AD flag).
Reverse lookups
Type an IPv4 or IPv6 address and the matching in-addr.arpa or ip6.arpa name is built for you.
DNS record types at a glance
| Record | What it holds | Typical use |
|---|---|---|
| A / AAAA | IPv4 / IPv6 address | Points a hostname at a server |
| CNAME | Another hostname | www → apex, CDN and SaaS hosting |
| MX | Mail server and priority | Where email for the domain is delivered |
| TXT | Free text | SPF, DMARC, DKIM, ownership verification |
| NS | Authoritative name servers | Who answers for the zone |
| SOA | Serial and timers | Zone version and caching rules |
| CAA | Certificate authority | Which CAs may issue TLS certificates |
| SRV | Host, port, priority, weight | SIP, XMPP, Minecraft, Microsoft 365 |
| PTR | Hostname for an IP | Reverse DNS, mail server reputation |
Reading SPF, DMARC and DKIM
SPF lives in a TXT record at the domain and lists the servers allowed to send its mail, ending with -all (fail), ~all (softfail) or ?all (neutral). It may trigger at most 10 DNS lookups; more and receivers treat it as a permanent error. DKIM publishes a public key at selector._domainkey.domain; the selector name is chosen by the mail provider (Google Workspace uses google, Microsoft 365 uses selector1 and selector2), so this tool tries the common ones. DMARC lives at _dmarc.domain and tells receivers what to do when SPF and DKIM both fail: p=none monitors only, quarantine sends to spam and reject blocks the message. Add rua=mailto: to receive aggregate reports.
TTL, propagation and status codes
The TTL is how many seconds a resolver may cache a record. After you change a record, old answers can be served until the previous TTL expires — that is “DNS propagation”. Lower the TTL to 300 seconds a day before a migration, then raise it again. NOERROR with no records means the name exists but has no record of that type (common for CNAME at the apex, which is not allowed). NXDOMAIN means the name does not exist at all. SERVFAIL usually means the authoritative servers are down, unreachable or failing DNSSEC validation — compare with a lookup of the name server’s IP to see where they are hosted.
The DNSSEC validated badge appears when Google Public DNS set the AD (authenticated data) flag, meaning the DNSKEY and DS chain checked out. A signed domain with a broken chain returns SERVFAIL. To inspect the keys themselves, choose the DNSKEY or DS record type. Once you know a domain’s address, the What Is My IP page shows your own, and the URL Parser breaks a full link into host, path and query.
DNS Lookup FAQ
What is a DNS lookup?
A DNS lookup asks the Domain Name System which records exist for a name — for example which IP address example.com points to or which servers receive its email. This tool sends that question to Google Public DNS over HTTPS and displays the answer with TTLs and status codes.
Why does my new DNS record not show up yet?
Resolvers keep the previous answer until its TTL expires, and some providers take a few minutes to publish changes to all their name servers. Because this tool queries Google Public DNS directly, it usually sees changes before your own ISP cache does. Wait for the old TTL to pass, then look up again.
How do I check my MX records?
Enter your domain, choose “MX — mail servers” and press Look up. Lower priority numbers are tried first. Choose “Email setup” to also check SPF, DMARC and DKIM in the same run.
What does NXDOMAIN mean?
Non-existent domain: the authoritative servers say there is no such name. Check for typos, and remember that a subdomain such as shop.example.com must be created separately from example.com.
Can I do a reverse DNS lookup here?
Yes. Type an IPv4 or IPv6 address and the tool builds the in-addr.arpa or ip6.arpa name and queries its PTR record. Mail servers without a matching PTR record are often treated as spam sources.
Is the DNS lookup free and private?
Yes. There is no account or limit. The only data sent is the domain name and record type, which goes to Google Public DNS — the same information any resolver receives when you visit a website.