DNS Lookup
Read every DNS record for a domain at once: A, AAAA, MX, TXT, NS, CNAME, SOA, CAA and SRV, with TTLs and DNSSEC status.
Read every DNS record for a domain at once: A, AAAA, MX, TXT, NS, CNAME, SOA, CAA and SRV, with TTLs.
Every record type is queried at once by default, because when something is wrong you usually do not know yet which record is at fault. Types that return nothing are left out rather than shown as empty rows.
TTL is how long a resolver may cache the answer, and it is the reason a change you made an hour ago has not taken effect yet. A record with a TTL of 24h can be served from caches for a full day after you edit it, so lowering the TTL before a migration is what makes the switch quick.
Answers come from Cloudflare, falling back to Google if it does not respond. Both are public resolvers, so what you see is what a third party sees rather than whatever your own network has cached.
About the dns lookup
When something is wrong with a domain you usually do not yet know which record is at fault, which is why being made to choose a record type before you can look is the thing that makes most DNS tools tedious. Every type is queried at once here, and the ones that return nothing are simply left out.
Answers come from public resolvers rather than from your own network, so what you see is what everyone else sees. That distinction matters during a migration, when your machine may still be serving a cached answer that the rest of the world stopped using hours ago.
TTLs are shown next to every record because they explain the question people actually have, which is why a change made an hour ago has not taken effect yet.
How to use it
- 1Enter a domain.
- 2Leave the type on All to see everything it publishes, or pick one to narrow it.
- 3Read the TTL to see how long resolvers may keep caching the old answer.
Questions
Why has my DNS change not taken effect?
Because of the TTL on the old record. Resolvers may serve the cached answer for that long after you edit it, so a record with a TTL of 24h can keep resolving to the old value for a full day. Lowering the TTL a day before a planned change is what makes the switch quick.
Whose answers am I seeing?
Cloudflare's public resolver, falling back to Google's if it does not respond. Both are outside your network, so this shows what a third party sees rather than whatever your own machine or ISP has cached.
What is a CAA record for?
It lists which certificate authorities are allowed to issue certificates for your domain. Publishing one stops any other CA from issuing, which closes off a real attack. Most domains have none.
What does DNSSEC signed mean?
That the zone's answers carry cryptographic signatures the resolver was able to validate, so they have not been tampered with in transit. It is not required, and most domains are unsigned.
Why do I see no records at all?
Either the domain does not exist, in which case that is stated, or it exists but publishes none of these types. A registered but unconfigured domain often has only NS and SOA records.
Can I look up an internal or private domain?
No. These are public resolvers and cannot see .local, .internal or anything else that only resolves inside your network.