DNS lookup tool
Query any record type for a domain through a public resolver of your choice. See values, TTLs, response codes and query time, the same data dig and nslookup show.
Results appear here. Choose record types above, then press Look up.
How DNS resolution actually works
Typing a name into a browser sets off a chain of up to four questions. Step through it, and tick "cached" to see why most lookups are almost instant and why record changes take time to reach everyone.
Step 1 of 5: Your device asks its resolver
The stub resolver in your OS sends "A record for www.example.com?" to the recursive resolver configured by DHCP: your router, your ISP, or a public one like 1.1.1.1. It sets the "recursion desired" flag: please do all the work.
DNS record types at a glance
| Type | Holds | Example value |
|---|---|---|
| A | IPv4 address | 93.184.215.14 |
| AAAA | IPv6 address | 2606:2800:21f:cb07::1 |
| CNAME | Alias to another name (not allowed at the zone apex) | shop.example.net. |
| MX | Mail server and priority (lower is tried first) | 10 mx1.example.com. |
| NS | Authoritative name servers for the zone | ns1.example-dns.com. |
| TXT | Free text: SPF, DMARC, DKIM, verification tokens | "v=spf1 include:_spf.google.com ~all" |
| SOA | Zone metadata: primary server, admin, serial, timers | ns1… hostmaster… 2026092701 … |
| CAA | Which CAs may issue certificates | 0 issue "letsencrypt.org" |
| SRV | Service location: priority, weight, port, target | 10 5 5060 sip.example.com. |
| PTR | Reverse mapping from IP to name | mail.example.com. |
| DS / DNSKEY | DNSSEC chain of trust | 2371 13 2 1F98… |
Do it from the command line
dig example.com A +noall +answer: just the answer lines. Add@1.1.1.1to pick a resolver,+traceto follow the delegation from the root.nslookup -type=mx example.com 8.8.8.8: works on Windows out of the box.Resolve-DnsName example.com -Type TXT: PowerShell's equivalent.
Prefer dig-style output here? Use dig online.
Questions people ask
What is a DNS lookup?
A DNS lookup asks the Domain Name System for records attached to a name: A and AAAA records hold IPv4 and IPv6 addresses, MX lists mail servers, NS names the authoritative servers, TXT carries verification and email-policy strings, CNAME points one name at another.
How is this different from nslookup?
nslookup asks whatever resolver your computer uses. This tool asks a public resolver of your choice over DNS-over-HTTPS, so you see what the internet at large sees, not your office's or ISP's cache. The output is the same data nslookup and dig show.
Why do I get different answers from different resolvers?
Each resolver caches answers for the record's TTL. After a change, some still serve the old value until their cached copy expires. Some large sites also return different IPs by location (GeoDNS). Use the propagation checker to compare eight at once.
What does NXDOMAIN mean?
The name does not exist at all: no records of any type. Check the spelling and that the domain is registered and delegated. NOERROR with no answers means the name exists but has no record of the type you asked for.
What does SERVFAIL mean?
The resolver tried but could not produce a trustworthy answer. Common causes: the authoritative servers are down or unreachable, or DNSSEC validation failed (for example a DS record at the registrar that no longer matches the zone's keys).
What TTL should I use?
Common values are 300 seconds (5 minutes) for records you may change soon, and 3600 to 86400 seconds for stable ones. Lower the TTL a day before a planned migration, then raise it again afterwards.