EN

DNS lookup

DNS lookup – enter a domain, pick a record type and click Look up: you instantly see which DNS records a public resolver (Cloudflare 1.1.1.1 or Google 8.8.8.8) returns for the name – with TTL and DNSSEC validation. An IP address is automatically reverse-resolved (PTR).

Source: RFC 8484 – DNS Queries over HTTPS (DoH). Updated: .

Internationalised domains (IDN) are converted to Punycode automatically; from a URL or email address only the domain part is used.
My ToolboxYour inputs are saved in this browser only.

The lookup goes through our server to Cloudflare or Google. The resolver learns the name you look up, not your IP address; we store nothing.Cloudflare privacy ·Google privacy

Result

Response status
–
Query
–
Response time
–
Email check
DNSSEC
–
Records
Authority section
What the records mean

    How it is calculated

    The Domain Name System (DNS) turns names like example.com into addresses and other data. This tool asks a public resolver over DNS over HTTPS (RFC 8484). The lookup goes through our server, which passes on only the name and type – the resolver does not learn your IP address, and we store neither the domain nor the result.

    How to run a DNS lookup

    1. Enter a domain, URL or IP address – for a URL the host name is used.
    2. Choose the record type (A, AAAA, MX, TXT, CNAME, NS …) and the resolver (Cloudflare or Google).
    3. Click “Look up” and read the response status, the records with TTL and the DNSSEC status.

    Record types

    TTL, status and DNSSEC

    The TTL (time to live) says in seconds how long a record may be cached. At the resolver it counts down – which is why you may still see the old value after a change until the TTL runs out. The status is the RFC 1035 response code: NOERROR (fine), NXDOMAIN (name does not exist), SERVFAIL (resolver got no valid answer) and so on. DNSSEC “validated” means the resolver checked the zone’s cryptographic signatures and set the AD bit (RFC 4035).

    Privacy

    Your browser only talks to our website; our server sends the query to Cloudflare or Google over DNS over HTTPS. Those providers see the name you look up, not your IP address, and their privacy policies apply (links above). We keep no logs and store nothing; only for the limit of 30 lookups per hour, a hash of your IP address is counted in memory for one hour. Nothing is sent when you open the page, only when you start a lookup.

    Several types at once and the email check

    With “All main types” the tool looks up A, AAAA, CNAME, MX, TXT, NS, SOA and CAA in one go and shows every record in one table; below it you can read what each type that occurs means. The “Email check” fetches MX, the domain’s SPF record and the DMARC record at _dmarc and rates them in plain words: is SPF missing? Does it end in -all, ~all or +all? Does it trigger more than 10 DNS lookups? Is DMARC set to none, quarantine or reject? For DKIM, enter the selector. The response time is measured between our server and the resolver, and “Copy result” puts the records on the clipboard in zone-file style. 30 lookups per hour are allowed; a lookup with several types counts once.

    Related tools: what is my IP address, the email validator and what is my user agent.

    Frequently asked questions

    Why do I still see the old value after changing a DNS record?

    Resolvers cache answers for as long as the TTL allows and only then ask the authoritative name server again. Compare both providers – often one already has the new value while the other does not yet.

    What does NXDOMAIN mean?

    The name does not exist in DNS – because of a typo, an expired domain or a subdomain that was never created. If the name exists but only lacks the chosen type, the status is NOERROR with no records (NODATA).

    How do I check SPF, DKIM or DMARC?

    Choose TXT. SPF sits on the domain itself (example.com), DMARC at _dmarc.example.com, DKIM at selector._domainkey.example.com – you find the selector in the header of a sent email (s=).

    How do I find the hostname for an IP address?

    Enter the IP address (IPv4 or IPv6) – the tool automatically runs a PTR lookup. Not every IP has a reverse record, but mail servers almost always need one.

    What does “DNSSEC validated” mean?

    The zone’s records are digitally signed and the resolver verified the chain of signatures up to the root. Without DNSSEC the data is not wrong – it is just not cryptographically protected.

    Who can see my lookup?

    Our server forwards the name and type to the resolver you picked (Cloudflare or Google). The resolver sees the name but not your IP address. We store neither the domain nor the result.

    Sources and legal basis

    As of: · Editorial policy

    Related tools