DNS lookup
Type a domain and pick a record type to see what DNS says right now. The query goes from your browser to Cloudflare or Google over HTTPS, and the results are explained in plain words. The email check reads a domain's SPF and DMARC records and points out common mistakes.
How it works
- •Enter a domain (a pasted address is cleaned up), choose A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, All, or Email check, and press Look up.
- •Each result shows the status (NOERROR, NXDOMAIN…), the records with their remaining TTL, and for MX, SOA and CAA the fields spelled out. An A record that follows a CNAME is shown as the resolver returned it.
- •Choose Both and the page asks Cloudflare and Google and tells you whether they agree. Differences are normal while a DNS change is still spreading.
- •Email check asks for TXT on the domain and on _dmarc.<domain>, then reads SPF (lookup count, the all rule) and DMARC (policy, reports).
What it does and what it cannot do
- •You see what public resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) have cached, not necessarily what your own network resolves. Results can differ by up to the TTL after a change.
- •Reverse lookups (PTR), DKIM keys (the selector is unknown), DNSSEC chain checks, WHOIS and zone transfers are not included.
- •If a browser extension, firewall or company network blocks cloudflare-dns.com or dns.google, the lookup fails; try the other resolver.
- •The resolvers see the domain you ask about and your IP address, under their own privacy policies. This site does not.
Questions
- What does NXDOMAIN mean?
- The name does not exist at all: it is not registered, expired, or mistyped. NOERROR with no records means the name exists but has no record of the type you asked for.
- Why do I see different answers from Cloudflare and Google?
- Each resolver caches answers separately for up to the record's TTL, and large sites answer differently by location. A short mismatch right after a change is normal.
- How do I check my SPF and DMARC?
- Pick Email check. SPF must be one TXT record starting with v=spf1 and needs ten or fewer DNS lookups. DMARC is a TXT record at _dmarc.yourdomain with at least v=DMARC1 and p=. Start with p=none and rua= to receive reports, then tighten.
- What is TTL?
- Time to live: how many seconds resolvers may keep the answer. The time shown is what is left in that resolver's cache. Lower the TTL before a planned change.
- Is it private?
- The lookup is sent straight from your browser to the resolver you choose. Our server never sees it.