DNS Lookup

Look up A, AAAA, MX, TXT, NS records and diagnose SPF/DMARC email security. Free online DNS checker.

Enter a domain and look up.

Waiting

Enter a domain and run a lookup to see results.

Records

—

Email Security

—

Propagation Status

—

JSON
—

Tool Features

Related Guides

Why DNS changes take time to propagate A/AAAA record checklist MX/SPF/DMARC basic checks
Pro DNS change monitoring with daily email alerts is available in security monitoring →

DNS Lookup & Security Diagnostics

Query A, AAAA, MX, TXT, NS, SOA and CAA records for any domain. Beyond the raw records, the tool checks DNSSEC status, checks that SPF and DMARC records exist, looks for DKIM keys and points out misconfigurations. Results include a severity-rated diagnosis with likely causes — not just a record dump.

How It Works

Records come from Cloudflare DNS-over-HTTPS, and A/AAAA answers are cross-checked on Cloudflare, Google and NextDNS. DNSSEC status is read from the AD (Authenticated Data) flag on Cloudflare's validated answer. CAA, SRV and PTR are queried too, and 18 common DKIM selectors are tried, including Google's date-based ones; when none answers, we check whether anything is published under _domainkey at all, so DKIM under an unknown selector is not reported missing. From Seoul, each name server is also asked directly for the zone's SOA (one question, no recursion), which shows a name server that does not answer, answers without authority (lame delegation) or is out of sync. The interpret layer then looks for known problems — missing SPF or DMARC, no DNSSEC and more — and tags each finding with a severity.

FAQ

What DNS records should every domain have?

At minimum: A or AAAA (points to your server), NS (nameservers), and SOA (zone authority). For email: MX (mail server), SPF (authorized senders via TXT), and DMARC (policy via TXT). DNSSEC is recommended for tamper-proofing.

Why do my DNS changes take time to appear?

DNS records are cached by resolvers worldwide according to the TTL (Time To Live) value. After a change, old cached values must expire before resolvers fetch the new record. Lower TTL = faster propagation but more DNS queries. Use our Propagation tool to check real-time status across global resolvers.

What does DNSSEC do?

DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that the response hasn't been tampered with. Without DNSSEC, attackers can poison DNS caches and redirect traffic. This tool checks the AD (Authenticated Data) flag to confirm DNSSEC validation.