DNS lookup

How to use

Enter a domain and choose a record type to see what the public DNS currently answers: A and AAAA for addresses, MX for mail, TXT for verification and policy records, CNAME for aliases and NS for the servers in charge of the zone.

There is no such thing as propagation, despite the word being everywhere. Every answer carries a TTL — how long a resolver may keep it — and old values persist simply because they are still cached. This is why the TTL must be lowered before a change, not after: once a resolver has an answer, nothing you do at the source reaches it until that clock expires.

Each row shows the name, the record type, the TTL and the value. The question goes to Cloudflare’s public resolver (1.1.1.1), with Google Public DNS as a fallback, so the TTL is the time that resolver has left before it must ask again: it counts down between lookups and is usually lower than the value set at your DNS host. When the name is an alias, the answer starts with its CNAME and then gives the records of the name it points to.

The status says whether the lookup worked. Successful means the name exists, even if it has no record of the type you chose. DNS 3 (NXDOMAIN) means the name does not exist at all — often a typo, or a subdomain that was never created. DNS 2 (SERVFAIL) means the resolver could not get a trustworthy answer, for example because the domain’s name servers do not respond or its DNSSEC signatures fail to validate.

Email depends on several records. MX records list the servers that receive mail for the domain, each with a priority: lower numbers are tried first, and the rows are not necessarily in that order. SPF is a TXT record on the domain itself that starts with v=spf1 and lists who may send its mail. DMARC is a TXT record on _dmarc followed by the domain, and DKIM keys sit on a name of the form selector._domainkey followed by the domain; names that start with an underscore can be looked up here too.

• DNS records explained: A, AAAA, CNAME, MX, TXT and NS

Example

Looks up the current IPv4 records for example.com. TTL indicates how long a resolver may cache each record; answers can change.

• example.com · MXA single record, 0 . — a null MX: the domain states that it accepts no email at all, so senders give up at once instead of retrying for days.
• example.com · TXTAmong its TXT records, v=spf1 -all says that no server is allowed to send email as example.com.
• _dmarc.example.com · TXTv=DMARC1;p=reject;… asks receiving servers to reject any message that claims to come from example.com and fails the checks.
• www.github.com · ATwo rows: a CNAME pointing to github.com, then the A record of github.com with its IPv4 address.
• gmail.com · MXFive servers with priorities 5, 10, 20, 30 and 40: mail goes to priority 5 first and moves to the next one only if it does not answer.
• A name that does not exist · AStatus DNS 3 (NXDOMAIN) and no records.

Frequently asked questions

I changed a record and still see the old value — why?

Something between you and the authoritative server is still holding the previous answer until its TTL runs out. Check the TTL on the record: if it is 86400, a resolver that cached it a minute before your change will keep serving the old value for the rest of the day.

What is the difference between an A record and a CNAME?

An A record points a name at an address; a CNAME points a name at another name. The practical consequence is that a CNAME cannot coexist with other records on the same name, which is why a domain root — the bare example.com, which needs NS and usually MX — normally cannot be a CNAME.

A record or AAAA record?

Same job, different address family: A returns an IPv4 address, AAAA an IPv6 one. A name can have both, and a browser on a dual-stack connection will usually try IPv6 first and fall back within a few hundred milliseconds.

Why is the TTL lower than the one I set?

Because the resolver has already held the answer for a while, and the TTL shown is the time it has left. Look the name up again and it keeps counting down; once it reaches zero, the next lookup makes the resolver fetch a fresh copy, and the count starts again from the full value.

How do I look up a DKIM key?

Look up the TXT record of selector._domainkey followed by the domain. The selector is chosen by the sender and appears as s= in the DKIM-Signature header of a message they sent; DNS has no way to list all of a domain’s selectors.