What is a DNS lookup?
The Domain Name System (DNS) is the internet's address book. When you type example.com, your device asks
DNS which IP address to connect to, which mail servers accept email for that domain, and more. A DNS lookup shows you
those answers directly, so you can check that a domain is configured correctly, debug a website or email that does
not work, or confirm that a change you made has gone live.
This tool queries a recursive resolver that asks the domain's authoritative name servers. You see the same records the rest of the internet sees, with their TTL (how long they may be cached).
How to use the DNS lookup tool
- Type a domain or paste a full URL.
https://www.example.com/pagebecomeswww.example.comautomatically. International names likemünchen.deare converted to punycode. - Choose a record type, or leave ALL to check A, AAAA, CNAME, MX, NS, TXT, SOA and CAA at once.
- Press Enter. Copy any value with one click, or use Copy all records to get a tab-separated list.
DNS record types explained
| Type | Purpose | Example value |
|---|---|---|
| A | The IPv4 address of the name. | 93.184.215.14 |
| AAAA | The IPv6 address of the name. | 2606:2800:21f:cb07:6820:80da:af6b:8b2c |
| CNAME | An alias: "this name is the same as that other name". | www.example.com → example.com |
| MX | Mail servers that receive email, with a priority (lower is tried first). | 10 mail.example.com |
| NS | The authoritative name servers for the domain: where its DNS is hosted. | ns1.example-dns.com |
| TXT | Free text. Used for SPF, DKIM, DMARC and domain verification. | v=spf1 include:_spf.google.com ~all |
| SOA | Start of Authority: the primary server, admin contact and timers of the zone. | ns1.example.com. admin.example.com. 2026111001 7200 3600 1209600 300 |
| CAA | Which certificate authorities may issue SSL/TLS certificates. | 0 issue "letsencrypt.org" |
How to read the results
TTL
Each record shows its TTL in seconds. It tells resolvers how long they can cache the answer. 300 means
5 minutes, 3600 one hour, 86400 one day. Before migrating a website or changing mail
providers, lower the TTL a day in advance so the switch propagates quickly, then raise it again afterwards.
MX priority
MX records are sorted by priority. Senders try the lowest number first and only use higher numbers if the first server is unavailable. Records with the same priority share the load.
TXT records
A domain usually has several TXT records: one SPF record (starting with v=spf1), verification tokens for
Google, Microsoft or other services, and sometimes others. When we detect an SPF record we link to our
SPF Checker so you can validate it. DMARC lives on a separate name,
_dmarc.yourdomain; check it with the DMARC Checker.
SOA
The SOA values are: primary name server, the responsible mailbox (with the first dot replaced by @), the serial number
(often a date like 2026111001), and the refresh, retry, expire and negative-caching timers in seconds.
The last value is how long resolvers cache "this record does not exist" answers.
Common DNS errors and what they mean
- NXDOMAIN: the domain does not exist. Check the spelling. If it is your domain, it may have expired; check it with our WHOIS Lookup.
- No records of this type: the domain exists but has no record of that type. For example, many domains have no AAAA record because they do not support IPv6 yet.
- SERVFAIL: the authoritative servers returned an error or could not be validated. Typical causes are broken DNSSEC (for example after changing DNS providers without removing the old DS record) or name servers that are down.
- Timeout: the name servers did not answer in time. They may be offline, overloaded or blocked by a firewall.
- REFUSED: the server refused to answer, often because the domain is delegated to name servers that are not configured to serve it.
Why are my DNS changes not showing?
This is the most common DNS question. Check these points in order:
- Are you editing the right place? Look at the NS records. Only the provider listed there controls your DNS. Editing records at your registrar has no effect if your name servers point to Cloudflare, for example.
- Has the old TTL expired? If the previous record had a TTL of 86400, resolvers may keep the old value for up to 24 hours.
- Is your own computer caching it? Your browser and operating system cache DNS too. This tool does not use your local cache, so it is a good way to see the real current value.
- Did you add the domain twice? In many control panels, entering
www.example.comas the name createswww.example.com.example.com. Usually you only typewww.
CNAME rules that cause problems
A name that has a CNAME cannot have any other record. That is why you cannot put a CNAME on the root of your domain
(example.com), which always needs NS and SOA records. Use A/AAAA records on the root, or a provider
feature such as "CNAME flattening" or "ALIAS" records, and use CNAME for subdomains like www or
shop.
Checking email DNS
For email to work and land in the inbox, a domain needs at least:
- An MX record pointing to your mail provider, so you can receive mail.
- An SPF TXT record listing the servers that send mail for you.
- A DKIM record (TXT or CNAME under
selector._domainkey) published by your provider. - A DMARC TXT record at
_dmarctelling receivers what to do with mail that fails.
Domains that send no email at all should publish v=spf1 -all and a DMARC record with
p=reject, so nobody can send fake mail in their name.
DNS and security
A few records make your domain safer: CAA limits who can issue certificates for you, DNSSEC protects DNS answers from tampering (check whether your domain is signed in the WHOIS results), and SPF/DMARC stop email spoofing. Review your DNS periodically and delete records that point to services you no longer use: a forgotten CNAME to a deleted cloud resource can let someone else take over your subdomain.