How to check DNS records
Enter the exact domain or hostname you want to check. example.com, www.example.com, and mail.example.com can each have different records, so use the name connected to the website, email service, or setup you are checking. Leave All selected to check every forward record type offered here, choose a DNS source, then select Look up DNS. To start with an IP address instead, choose PTR and enter the address.
When the answer appears, compare it with the records in your DNS provider. Public resolvers may keep an older answer in cache for a while. The authoritative option skips that cache and asks a nameserver that hosts the domain.
What DNS lookup results mean
Read the returned value first. If the result shows an alias path, the name you entered points to another hostname and the final record belongs there. The owner name stays visible so you can see exactly where the answer came from.
www.example.comedge.example.net192.0.2.42www.example.com is an alias. The A record belongs to edge.example.net, so that owner name stays attached to the address in the result.Resolver TTL is how much cache time a public resolver reported at the moment you looked. TTL, or time to live, is roughly how long a resolver is allowed to reuse an answer before checking again. So 300 seconds means about five minutes were left when the lookup ran. This number is often lower than the TTL the domain owner set, because part of that time has already ticked away. When you ask a nameserver directly, you see Authoritative TTL instead.
Which DNS record type should you check?
Not sure where to start? Leave All selected. It checks the domain record types offered by this tool, including website, email, service, verification, nameserver, and DNSSEC records. PTR is separate because it starts with an IP address. If you already know what you are looking for, this table will help you choose one type.
| Type | What it shows |
|---|---|
| A | The IPv4 address for a domain or hostname. Check this when a website is opening the wrong server. |
| AAAA | The IPv6 address for a domain or hostname. It is worth checking when a website works on some networks but not others. |
| CNAME | The other hostname that an alias points to. You will often see this on www addresses, hosted services, and CDN setups. |
| MX | The servers that should receive email for the domain. A smaller preference number is tried first. |
| NS | The nameservers responsible for the domain. Check these after moving DNS to a new provider. |
| TXT | Text added for domain verification and email policies. You can read the value here, but this lookup does not tell you whether SPF, DKIM, or DMARC is configured correctly. |
| CAA | The certificate authorities allowed to issue certificates for the domain. |
| SOA | Basic information about the DNS zone, including its primary nameserver, serial number, and timing values. This is mostly useful when troubleshooting DNS provider changes. |
| SRV | The hostname and port used by a particular service, along with the order in which servers should be tried. |
| DS | A record in the parent zone that points to the DNSSEC key it trusts for this domain. |
| DNSKEY | The public keys the domain publishes for DNSSEC. Seeing a key here does not prove that the full DNSSEC setup is correct. |
| PTR | The hostname connected to an IPv4 or IPv6 address. This is often called reverse DNS and is useful when checking mail servers, logs, or an unfamiliar address. |
When a DNS lookup helps
This tool is handy when something should be working or should have changed, and you want to see what public DNS is actually returning. If you know what value your provider gave you, compare it with the answer here.
| What is happening | Check | What to look for |
|---|---|---|
| A website opens the wrong server | A, AAAA, and CNAME | Does the address or alias match the value from your host or CDN? |
| Email is not reaching the right place | MX | Do the mail servers and preference numbers match your email provider's setup? |
| A service is still waiting to verify your domain | TXT | Is the complete text value present on the exact name the service asked you to use? |
| A certificate cannot be issued | CAA | Do the CAA records allow the certificate authority you are using? |
| You moved to new nameservers | NS and SOA | Do the NS records show the new provider, and does the SOA information belong to the new zone? |
| You are checking DNSSEC | DS and DNSKEY | Are both records present? This is a useful first look, but a full DNSSEC chain check is still needed to find configuration problems. |
| You need the hostname behind an IP address | PTR | Does the returned hostname match the server or service you expected to find? |
When the answer looks wrong
No record does not always mean the whole domain is broken. The name may exist without having the particular record type you asked for. The response below tells you what happened with this exact lookup.
| Response | What it means |
|---|---|
| NOERROR with records | The lookup worked and the resolver found the record type you asked for. |
| NOERROR without records | The name exists, but it does not have this record type. For example, a hostname can have an A record without having an MX record. |
| NXDOMAIN | The exact name does not exist according to this resolver. Check the spelling and make sure you used the right root domain or subdomain. |
| SERVFAIL | The resolver could not get a usable answer. The cause may be temporary, or it may involve the nameserver setup or DNSSEC. This response alone cannot tell you which one. |
| REFUSED | The resolver decided not to answer this query, usually because of its own rules. It does not prove that the domain itself is broken. |
Public resolvers can show different answers for a while after a DNS change because each one may have cached the old value at a different time. Check the returned values and Resolver TTL. You can also choose Authoritative nameserver to see what the domain's DNS host answers without waiting for a public resolver cache.
Remember that this tool only shows the DNS answer. It does not open the website, send a test email, validate SPF, DKIM, or DMARC, or check every resolver around the world.