DNS lookup
Enter a domain, pick a record type and click Look up: you instantly see which DNS records a public resolver (Cloudflare 1.1.1.1 or Google 8.8.8.8) returns for the name – with TTL and DNSSEC validation. An IP address is automatically reverse-resolved (PTR).
How it is calculated
The Domain Name System (DNS) turns names like example.com into addresses and other data. This tool asks a public resolver over DNS over HTTPS (RFC 8484) – encrypted, straight from your browser. There is no server of ours in between, so we never see the domain or the result.
Record types
- A / AAAA: the server’s IPv4 or IPv6 address.
- CNAME: an alias – the name points to another name (e.g.
www→ a CDN). - MX: the domain’s mail servers with priority (lower number = preferred).
- TXT: free text, today mostly SPF (
v=spf1 …), DKIM, DMARC (_dmarc.domain) and verification codes. - NS / SOA: the authoritative name servers and the zone’s admin data (serial number, refresh timers).
- CAA: which certificate authorities may issue TLS certificates for the domain (RFC 8659).
- SRV: where a service lives, queried as
_service._proto.domain, e.g._sip._tcp.example.com. - PTR: reverse DNS – the name behind an IP address. Just type the IP; the tool builds the
…in-addr.arpaor…ip6.arpaname for you.
TTL, status and DNSSEC
The TTL (time to live) says in seconds how long a record may be cached. At the resolver it counts down – which is why you may still see the old value after a change until the TTL runs out. The status is the RFC 1035 response code: NOERROR (fine), NXDOMAIN (name does not exist), SERVFAIL (resolver got no valid answer) and so on. DNSSEC “validated” means the resolver checked the zone’s cryptographic signatures and set the AD bit (RFC 4035).
Privacy
The query goes straight from your browser to Cloudflare or Google – not to us. Those providers see your IP address and the name you look up, and their privacy policies apply (links above). Nothing is sent when you open the page, only when you start a lookup.
Frequently asked questions
Why do I still see the old value after changing a DNS record?
Resolvers cache answers for as long as the TTL allows and only then ask the authoritative name server again. Compare both providers – often one already has the new value while the other does not yet.
What does NXDOMAIN mean?
The name does not exist in DNS – because of a typo, an expired domain or a subdomain that was never created. If the name exists but only lacks the chosen type, the status is NOERROR with no records (NODATA).
How do I check SPF, DKIM or DMARC?
Choose TXT. SPF sits on the domain itself (example.com), DMARC at _dmarc.example.com, DKIM at selector._domainkey.example.com – you find the selector in the header of a sent email (s=).
How do I find the hostname for an IP address?
Enter the IP address (IPv4 or IPv6) – the tool automatically runs a PTR lookup. Not every IP has a reverse record, but mail servers almost always need one.
What does “DNSSEC validated” mean?
The zone’s records are digitally signed and the resolver verified the chain of signatures up to the root. Without DNSSEC the data is not wrong – it is just not cryptographically protected.
Who can see my lookup?
Only the resolver you picked (Cloudflare or Google): your browser sends the query directly to it. Our website is not involved and stores nothing.
Sources and legal basis
- RFC 8484 – DNS Queries over HTTPS (DoH)
- § 2.3.4 (Längen), § 3.2.2 (Typen), § 3.5 (in-addr.arpa), § 4.1.1 (RCODE): RFC 1035 – Domain Names: Implementation and Specification
- RFC 3596 – DNS Extensions to Support IPv6 (AAAA, ip6.arpa)
- RFC 2782 – DNS RR for specifying the location of services (SRV)
- RFC 8659 – DNS Certification Authority Authorization (CAA)
- § 3.2.3 (AD-Bit): RFC 4035 – DNSSEC Protocol Modifications
- § 2.2 (RCODE 6–10): RFC 2136 – Dynamic Updates in the DNS
- Cloudflare 1.1.1.1 – DNS over HTTPS, JSON format
- Google Public DNS – JSON API for DNS over HTTPS
- Cloudflare 1.1.1.1 – Public DNS resolver privacy commitments
- Google Public DNS – Privacy
- WHATWG URL Standard – Host parsing (IDNA/UTS #46, Punycode)
As of:
Related tools
- What is my IP address?Instantly shows your public IP address, detects IPv4 or IPv6 and explains the difference. Free, no sign-up – your IP address is never stored.
- UUID generator: create and validate UUID v4 and v7Generate UUIDs online: version 4 (random) or version 7 (time-ordered), up to 1,000 at once. Validate a UUID and decode its version, variant and timestamp.
- Unix timestamp converterConvert a Unix timestamp to a date and back. Seconds, milliseconds, micro- and nanoseconds detected automatically; UTC, local time, ISO 8601 and more.
- Validate Email Address SyntaxCheck one or many email addresses for correct syntax under RFC 5321/5322: lengths, domain labels, international domains (Punycode). Local, nothing sent.
- What is my user agent?See your user agent string and detect browser, version, engine, OS and device type, plus User-Agent Client Hints. Parse any other UA too. Runs locally.
- Hash Generator: SHA-256, SHA-512, SHA-1, MD5Calculate SHA-256, SHA-384, SHA-512, SHA-1 and MD5 hashes of text or files and verify checksums – locally in your browser, no upload, free.