DNS Lookup
Free DNS lookup for A, AAAA, MX, TXT, NS, SOA, CAA and 10 more record types, with TTLs, DNSSEC status and a three-resolver compare mode.
Updated
A name, a URL, or an IP address for a reverse lookup.
Options
Enter a domain name or an IP address, then select Look up.
What Is a DNS Lookup?
The DNS lookup tool queries public DNS resolvers for the records of a domain name and shows each record with its TTL. Look up the common types at once (A, AAAA, CNAME, MX, NS, TXT, SOA and CAA) or one of 15 types, including PTR, SRV, DS, DNSKEY, HTTPS, SVCB and TLSA. Enter an IP address to get its reverse DNS name. Each result says whether the resolver validated the answer with DNSSEC and tells a name that does not exist apart from a name with no records of the asked type. Compare mode puts the answers of three public resolvers side by side.
How to Use the DNS Lookup
- Enter a domain name such as example.com, a URL, or an IP address.
- The lookup covers the common record types. To pick one type, open Options.
- To compare Cloudflare, Google and Quad9, open Options, pick one type and tick the compare box.
- Select Look up. Copy the dig-style answer or the records, or copy a link that runs the same lookup.
How It Works
The tool sends each query as a DNS message over HTTPS, the protocol RFC 8484 defines for sending DNS queries and getting DNS responses over HTTPS. Queries go to Cloudflare's public resolver at 1.1.1.1. In compare mode they also go to Google Public DNS at 8.8.8.8 and to Quad9's unfiltered service at 9.9.9.10. If Quad9's HTTPS endpoint turns a request down, the tool sends the same query to Quad9 over DNS over TLS, which servers accept on port 853 (RFC 7858). Answers come back in the DNS wire format, so a TXT record keeps the boundaries of the strings it was published in.
Every answer carries a response code from the IANA registry. 0 (NOERROR) means no error, 2 (SERVFAIL) is a server failure, 3 (NXDOMAIN) is a non-existent domain, 4 (NOTIMP) means not implemented, and 5 (REFUSED) means the query was refused. RFC 2308 calls a NOERROR answer with no records of the asked type NODATA. The name is valid, but it has no records of that type.
Negative answers are cached too. With NXDOMAIN and NODATA, the server includes the zone's SOA record in the authority section, and the TTL of that record says how long a resolver may cache the negative answer. The tool shows that TTL next to the result.
Every query asks for DNSSEC records. When Cloudflare sets the AD flag, every record in the answer was verified with DNSSEC. Quad9 validates DNSSEC on all its resolver addresses, and Google validates unless the query turns validation off. When validation fails, resolvers answer SERVFAIL and can attach an Extended DNS Error (RFC 8914) that names the cause, such as DNSKEY Missing. The tool then asks Cloudflare again with checking disabled. In that mode Cloudflare still fetches the DNSSEC records but does not validate them, so the tool lists those records separately.
Compare mode sends one query to three resolvers, all from Cloudflare's network. It is not a map of resolvers around the world. Google's documentation describes sending part of the client's IP address to authoritative name servers for geographic location accuracy, so a site that answers by location can give each resolver a different address. Each cached answer is used until its TTL runs out.
ANY queries are not offered. Authoritative name servers need not return all records for an ANY query, and some return only one record.
Record Types
| Type | Value | Meaning | Defined in |
|---|---|---|---|
| A | 1 | A host address (IPv4) | RFC 1035 |
| AAAA | 28 | An IPv6 address | RFC 3596 |
| CNAME | 5 | The canonical name for an alias | RFC 1035 |
| MX | 15 | Mail exchange | RFC 1035 |
| NS | 2 | An authoritative name server | RFC 1035 |
| TXT | 16 | Text strings | RFC 1035 |
| SOA | 6 | Marks the start of a zone of authority | RFC 1035 |
| CAA | 257 | Certification authority restriction | RFC 8659 |
| SRV | 33 | Server selection | RFC 2782 |
| PTR | 12 | A domain name pointer | RFC 1035 |
| DS | 43 | Delegation signer | RFC 4034 |
| DNSKEY | 48 | A public key used to authenticate DNSSEC-signed records | RFC 4034 |
| HTTPS | 65 | SVCB-compatible type for use with HTTP | RFC 9460 |
| SVCB | 64 | General-purpose service binding | RFC 9460 |
| TLSA | 52 | Associates a TLS server certificate or public key with a domain name | RFC 6698 |
DNSSEC Status
| Status | Meaning |
|---|---|
| Validated | Every record in the answer was verified with DNSSEC. |
| Not validated | The resolver did not mark the answer as verified with DNSSEC. |
| Failed | The resolver answered SERVFAIL with a DNSSEC error code. |
Standards
Scope
What It Checks
- +Looks up 15 record types, or the 8 common types in one request, and shows each record with its TTL.
- +Turns an IPv4 or IPv6 address into its reverse DNS name and looks up the PTR record.
- +Tells NXDOMAIN (the name does not exist) apart from NODATA (the name exists, with no records of the type), with the negative-answer TTL.
- +Shows the DNSSEC status of each answer and the Extended DNS Error text of a failed validation, then lists the records the zone returns with validation turned off.
- +Compares one record type across the Cloudflare, Google, and Quad9 resolvers and says whether their answers agree.
- +Copies the answer as dig-style text or as a plain list of records.
What It Does Not Check
- -It does not query from your own network, your ISP, or other locations. Every query leaves from Cloudflare's network.
- -It does not ask the domain's authoritative name servers directly.
- -It does not offer ANY queries.
- -It does not look up private or reserved IP addresses.
Defensive Use
DNSSEC signs DNS records so that resolvers can authenticate them, and the public keys for that check are stored in DNSKEY records. A lookup shows whether the resolver validated a domain's answers and, when validation fails, the Extended DNS Error that names the cause. It also shows the CAA records, which list the certification authorities a domain holder authorizes to issue certificates for the domain.
Frequently Asked Questions
What is a DNS Lookup?→
The DNS lookup tool queries public DNS resolvers for the records of a domain name and shows each record with its TTL. Look up the common types at once (A, AAAA, CNAME, MX, NS, TXT, SOA and CAA) or one of 15 types, including PTR, SRV, DS, DNSKEY, HTTPS, SVCB and TLSA. Enter an IP address to get its reverse DNS name. Each result says whether the resolver validated the answer with DNSSEC and tells a name that does not exist apart from a name with no records of the asked type. Compare mode puts the answers of three public resolvers side by side.
What is the DNS Lookup used for?→
Checking that a DNS change is live on public resolvers, finding the mail servers or TXT verification records of a domain, reading the CAA records before ordering a certificate, and seeing why a domain fails DNSSEC validation.
Is my data sent anywhere?→
The DNS Lookup sends the domain name or IP address you enter to ImmunitySec servers, which run the check and return the result. To run it, they contact the public DNS resolvers of Cloudflare, Google and Quad9, over DNS over HTTPS or DNS over TLS. Nothing else you enter leaves the page.
How is the DNS Lookup used defensively?→
DNSSEC signs DNS records so that resolvers can authenticate them, and the public keys for that check are stored in DNSKEY records. A lookup shows whether the resolver validated a domain's answers and, when validation fails, the Extended DNS Error that names the cause. It also shows the CAA records, which list the certification authorities a domain holder authorizes to issue certificates for the domain.
What is the difference between NXDOMAIN and NODATA?→
NXDOMAIN is the response code for a non-existent domain: the name has no records of any type. NODATA is a NOERROR answer with no records of the asked type. RFC 2308 describes it as a name that is valid but has no records of the given type, for example a domain with an A record and no MX record.
Why do resolvers return different IP addresses for the same name?→
Authoritative name servers can choose an answer by the location of the network that asks. Google Public DNS sends approximate network information to authoritative servers for this reason. Sites that answer by location give each resolver the address for its own network. A resolver also keeps a cached answer until its TTL runs out, so an old address can stay visible for up to one TTL after a change.
What does DNSSEC validated mean?→
The resolver set the AD flag, which means every record in the answer was verified with DNSSEC. DNSSEC uses public key cryptography to sign and authenticate DNS record sets, and the public keys are stored in DNSKEY records.
What is a null MX record?→
A domain that does not accept email can publish a single MX record with preference 0 and a zero-length label, written as a dot (RFC 7505). The tool shows it as a null MX instead of a mail server.
Why is there no ANY lookup?→
Google's DNS over HTTPS documentation notes that authoritative name servers need not return all records for ANY queries. Some do not respond, and others return only an HINFO record. Pick Common to look up the eight most used types in one request.
Answers come from the Cloudflare, Google Public DNS, and Quad9 public resolvers. Response code and Extended DNS Error names follow the IANA DNS parameters registries.