How to use the DNS Lookup tool
- Type a domain name such as example.com, or an IP address.
- Pick a record type, or keep “ALL” for the common ones plus SPF and DMARC.
- Click “Look up” and read or copy the records.
What each record type does
- A / AAAA: the IPv4 / IPv6 address of the name.
- CNAME: an alias pointing to another name. It cannot coexist with other records on the same name.
- MX: the mail servers for the domain, with priorities (lower is tried first).
- NS: the authoritative name servers.
- TXT: free text, used for SPF, DKIM, DMARC and domain verification (Google, Microsoft and others).
- SOA: zone settings: primary server, contact, serial number and timers.
- CAA: which certificate authorities may issue TLS certificates for the domain.
- PTR: reverse DNS, from an IP address back to a name. Mail servers check it.
Troubleshooting with DNS
Most “the site is down” and “emails go to spam” problems trace back to DNS. A few things to check first:
- Changed a record and nothing happened? Look at the TTL: resolvers may keep the old value for that many seconds.
- Mail rejected or in spam: there should be exactly one SPF record (TXT starting with v=spf1) and a DMARC record at _dmarc.yourdomain.
- NXDOMAIN means the name does not exist at all; an empty answer means the name exists but has no record of that type.
- Certificate errors after adding a CAA record: make sure your certificate authority, for example letsencrypt.org, is listed.
This tool asks a public recursive resolver, so you see what the internet sees. Right after a change, results can differ from what your own computer or provider sees until caches expire.
Privacy
Queries go directly from your browser to Cloudflare’s public DNS-over-HTTPS resolver (with Google Public DNS as a fallback). They do not pass through our server.
Frequently asked questions
How long do DNS changes take?
Up to the TTL of the old record, usually from 5 minutes to 24 hours. Lower the TTL a day before a planned change.
Why do I see a different IP than my colleague?
Caches, geo-based DNS (CDNs answer with the nearest server) or a local hosts file entry.
What does the DNSSEC line mean?
If the resolver validated the answer with DNSSEC, the domain is signed and the signatures are correct.
Can I look up DKIM records?
Yes, if you know the selector: choose TXT and enter selector._domainkey.yourdomain.