Query A, AAAA, MX, TXT, NS, CNAME and more via DNS-over-HTTPS
DNS Lookup Tool queries DNS records for any domain name in real time: A (IPv4 address), AAAA (IPv6 address), CNAME (canonical name), MX (mail exchange), NS (name servers), TXT (text records including SPF/DKIM/DMARC), SOA (start of authority), and PTR (reverse DNS) records. It shows the response from multiple public DNS resolvers (Google 8.8.8.8, Cloudflare 1.1.1.1) and displays TTL values and propagation status.
DNS (Domain Name System) is the internet's phone book — it translates human-readable domain names (example.com) into IP addresses that routers and servers understand. Every internet connection starts with a DNS lookup. The DNS lookup process: your browser asks a recursive resolver (your ISP's or a public resolver like 8.8.8.8), which checks its cache or queries the authoritative name servers for the domain.
Common use cases: verifying that DNS changes have propagated after updating records, debugging email delivery issues (checking MX and SPF records), confirming SSL certificate domain validation (checking TXT records), investigating domain redirects (CNAME chains), reverse-engineering domain infrastructure, and checking for DNS-based security controls (DMARC, DNSSEC).
Check mail server for gmail.com
Result: MX query → google.com. (priority 10), google.com. (priority 20), google.com. (priority 30, 40, 50)
Verify SPF record
Result: TXT query for example.com → 'v=spf1 include:_spf.google.com ~all'
Find CDN in use
Result: CNAME query → img.example.com → d1234567.cloudfront.net → CloudFront CDN identified
What is TTL in DNS and how does it affect propagation?
TTL (Time To Live) is the number of seconds a DNS record can be cached by resolvers before they must re-query the authoritative name server. A TTL of 300 means resolvers cache the record for 5 minutes. After changing a DNS record, full propagation takes up to the old TTL duration — if TTL was 86400 (1 day), some users may see the old record for up to 24 hours. Lower TTL before planned DNS changes to speed up propagation.
What is the difference between authoritative and recursive DNS?
An authoritative DNS server holds the actual DNS records for a domain — it's the source of truth. A recursive (caching) resolver is what your device queries — it looks up records by querying authoritative servers and caches the results. When you query 8.8.8.8 (Google's public recursive resolver), it may return a cached result. To see the actual authoritative record, query the domain's name server directly.
How do SPF, DKIM, and DMARC records work?
These three TXT records authenticate email: SPF (Sender Policy Framework): lists the servers authorized to send email for your domain (v=spf1 include:mailserver.com ~all). DKIM (DomainKeys Identified Mail): adds a cryptographic signature to outgoing email, verified via a public key in a TXT record at selector._domainkey.yourdomain.com. DMARC: tells receiving servers what to do with emails that fail SPF/DKIM — p=none (monitor), p=quarantine (spam), p=reject (block). All three together prevent email spoofing.
What is a CNAME record and can a root domain have one?
A CNAME (Canonical Name) record is an alias pointing to another domain name rather than an IP address. example.com CNAME → target.cdn.com means browsers first resolve target.cdn.com to get the IP. Root domains (apex domains, @, example.com) technically cannot have CNAME records per the DNS spec — a root domain must have A/AAAA records. Many DNS providers (Cloudflare, AWS Route 53) implement 'CNAME flattening' or ALIAS records to work around this limitation.
What does negative TTL / NXDOMAIN mean?
NXDOMAIN (Non-Existent Domain) is the response when a DNS record doesn't exist. Negative TTL (from the SOA record's minimum field) controls how long resolvers cache NXDOMAIN responses. If a domain doesn't exist, resolvers cache that 'not found' answer for the negative TTL duration. This means newly registered domains may show NXDOMAIN for up to the negative TTL period even after adding DNS records.