NetDetectHubGet the app

Home / Tools

DNS lookup

Ask a public DNS resolver for any record of a domain and get the answer in plain English: what the name points to, how long the answer may be cached, and whether DNSSEC checked out.

Try:

How to use it

  1. Type a name in Domain name, such as example.com or www.example.com.
  2. Pick a Record type. For PTR you can type an IP address and the tool builds the reverse name.
  3. Choose a Resolver (Cloudflare unless you change it) and press Check.
  4. After a change, press Check again. Copy link shares the exact name, type and resolver.

Record types you can look up

The 13 types in the Record type list
TypeWhat it holdsExample value
AIPv4 address of the name192.0.2.10
AAAAIPv6 address of the name (RFC 3596)2001:db8::10
CNAMEAlias: this name is another nameexample.com
MXMail server with a preference number; lower is tried first10 mail.example.com
TXTFree text: SPF, DMARC, site-verification codesv=spf1 -all
NSName servers that hold the zonens1.example.com
SOAZone settings: primary server, contact, serial, timers–
CAAWhich certificate authorities may issue certificates (RFC 8659)0 issue "ca.example.net"
SRVHost and port for a service such as SIP or XMPP10 5 5060 sip.example.com
PTRReverse DNS: the name behind an IP addresshost.example.com
HTTPSConnection hints for browsers, such as HTTP/3 support (RFC 9460)1 . alpn=h2,h3
DSDNSSEC link from the parent zone to this zone's key–
DNSKEYThe zone's DNSSEC public keys–

Reading the result

  • 2 A records: the name has records of that type. Each row shows Name, TTL (cache time) and Value.
  • Alias chain (CNAME): the name you typed is an alias. The resolver followed it, and the table shows each step.
  • The name exists but has no record of that type: try another type.
  • This name doesn't exist (NXDOMAIN): a typo, or the record was never created.
  • The lookup failed (for example SERVFAIL): the domain's name servers didn't answer properly. Check them in a WHOIS lookup.
  • DNSSEC shows Validated when the answer was signed and the resolver checked the signature.

TTL and negative caching

Every record carries a TTL: the number of seconds a resolver may cache it before asking again (RFC 1035). The tool writes it in readable form, so 3600 becomes 1 h. A cached TTL counts down, so it differs between two lookups.

A 'doesn't exist' answer is cached too. RFC 2308 sets that time to the lower of the SOA record's own TTL and its minimum field, and the tool shows it as Resolvers remember that for. Worked example: someone looks up shop.example.com before you create it. If the SOA TTL is 900 and its minimum is 3600, resolvers may keep answering NXDOMAIN for up to 900 seconds, 15 minutes.

Why answers can differ

The query goes from this site's server on Cloudflare to the resolver you picked, over encrypted DNS-over-HTTPS, so the answer can differ from what your ISP's resolver tells your device. Each resolver also caches on its own, so right after a change one can return the old value and another the new one. To compare seven resolvers and six regions at once, use the DNS propagation checker.

Fixing common problems

  • Moved a site but still reach the old server? If the A record here shows the new address, the old one is cached on your device or at your ISP. Flush the DNS cache or wait out the TTL.
  • E-mail not arriving? Check MX, then SPF with the SPF checker.
  • A certificate won't issue? A CAA record that doesn't name your certificate authority stops it from issuing for the domain.
  • Need the name behind an address? Choose PTR and type the IP: 192.0.2.10 becomes 10.2.0.192.in-addr.arpa.

Questions

Which resolver is best to pick?
Pick the one your device or router uses to see what it sees, or another to rule out a resolver problem.
What does the HTTPS record do?
It tells browsers before they connect which protocols the server supports, such as h2 or h3, and can carry address hints. It's defined in RFC 9460.
Why is DNSSEC 'Not validated'?
Most domains aren't signed. For a signed domain, try Cloudflare or Google Public DNS, which validate.
Can it look up a subdomain?
Yes. Type the full name, such as www.example.com: each name has its own records.
Is my lookup logged?
No. The resolver sees a query from this site's server, not from you, and this site keeps no record of it. See how our tools work.

Sources ·

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.