DNS Lookup
A, AAAA, MX, TXT, NS, CAA and more, plus SPF, DMARC and DKIM checks. Runs in your browser.
About this dns lookup
This DNS lookup queries the records of any domain from your browser: A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, PTR, DS, DNSKEY and HTTPS. It shows each record's TTL, whether the answer passed DNSSEC validation, and what each value means. It is built for site owners, developers and anyone setting up email.
Pick one type or All, and choose Cloudflare, Google, or Compare to ask both and highlight any difference. Enter an IP address and it runs a reverse (PTR) lookup instead. A second mode checks a domain's email authentication: SPF with a full lookup count, DMARC tag by tag, and DKIM keys with their size.
Queries go over encrypted DNS-over-HTTPS to the resolver you pick, and the page says which one before you press Look up. Nothing else is sent.
Features
Every common record type
A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV, PTR, DS, DNSKEY and HTTPS, or an All sweep that asks 11 types at once and hides the empty ones.
TTL and DNSSEC on every answer
TTLs are shown in plain units (5 min, 1 h, 1 d) with the exact seconds on hover. The AD flag tells you whether the resolver validated the DNSSEC signatures.
Cloudflare vs Google, side by side
Compare mode queries both resolvers and lines up every value with each one's TTL. Missing values are marked in red, which is how a change that is still propagating shows up.
Values explained
MX priorities, SOA timers, CAA issuers, SRV ports, DS digest types and DNSKEY roles are spelled out. TXT records are labelled when they are SPF, DMARC, DKIM, MTA-STS, BIMI or a site-verification token.
SPF with a real lookup count
The SPF check follows every include: and redirect= recursively and adds up the DNS lookups toward the limit of 10 set by RFC 7208. Each mechanism gets a plain-English line, and risky ones such as +all or ptr are flagged.
DMARC and DKIM decoded
DMARC tags (p, sp, pct, rua, adkim, aspf and more) are explained with warnings for weak settings. For DKIM, enter a selector or let the tool try 16 common ones; it reports the key type and its size in bits.
How to use the dns lookup
- 1Enter a domain, hostname or IP address.
- 2Pick a record type or All, and a resolver or Compare.
- 3Read the records with TTLs, or switch to SPF, DMARC, DKIM for an email check.
When to use it
Moving a website to new hosting
After changing the A record, run Compare. If Cloudflare shows the new IP and Google still shows the old one, the change is live and just waiting for the old TTL to expire.
Fixing email that lands in spam
Switch to the email check. A missing DMARC record, an SPF record with 12 lookups, or a 1024-bit DKIM key are the usual suspects, and each is called out with what to change.
What do the DNS record types mean?
Each record type answers a different question about a name. These are the ones you will meet most often:
- A and AAAA: the IPv4 and IPv6 addresses of the name.
- CNAME: an alias. The resolver follows it to another name and returns that name's records.
- MX: which servers accept email for the domain, with a priority. Lower numbers are tried first.
- TXT: free text, used for SPF, DMARC, DKIM and ownership proofs for services such as search consoles.
- NS and SOA: which name servers are authoritative for the zone, and its admin contact, serial number and timers.
- CAA (RFC 8659): which certificate authorities may issue certificates for the domain.
- SRV (RFC 2782): the host and port for a service, such as _sip._tcp or _xmpp-server._tcp.
- PTR: reverse DNS, turning an IP address back into a name.
- HTTPS (RFC 9460): hints that tell browsers about HTTP/3 support and IP addresses before they connect.
What is TTL, and why do DNS changes take time?
TTL (time to live) is how many seconds a resolver may cache a record before asking again. If your old A record had a TTL of 3600, resolvers that fetched it just before your change can keep serving it for up to an hour.
There is no single global moment when a change "propagates". Each resolver refreshes on its own clock. A practical trick: lower the TTL to 300 a day before a planned move, make the change, then raise it again once everything points to the new place.
How do I check SPF, DMARC and DKIM?
These three records decide whether receivers trust mail that claims to come from your domain. Since February 2024, Gmail and Yahoo require SPF or DKIM from every sender, and SPF, DKIM and DMARC from anyone sending 5,000 or more messages a day to their users.
SPF (RFC 7208) lists the servers that may send for the domain. It may trigger at most 10 DNS lookups in total, counting every nested include. Go over and receivers return a permanent error, which counts as a fail. DMARC (RFC 7489) tells receivers what to do when checks fail: nothing (p=none), spam folder (quarantine) or refuse (reject). DKIM (RFC 6376) publishes a public key at selector._domainkey.yourdomain so receivers can verify each message's signature. RFC 8301 sets a minimum of 1024-bit RSA; 2048 bits is the usual recommendation.
What does the DNSSEC AD flag mean?
DNSSEC signs DNS records so a resolver can prove they were not tampered with on the way. When the resolver checks the signatures and they are valid, it sets the AD (Authenticated Data) flag on the answer. Unsigned zones simply come back without it.
A SERVFAIL on a signed domain usually means the signatures are broken, often because the DS record at the registry no longer matches the zone's keys after a DNS provider change. You can see the DS record the registry holds with the WHOIS lookup.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Resolvers | Cloudflare and Google, or both compared | One resolver, often unnamed |
| TTL and DNSSEC flag | Shown for every answer | Often hidden |
| SPF lookup count | Recursive, counts every nested include | Top-level record only |
| DKIM | 16 common selectors tried, key size reported | Selector required, no key analysis |
| Encrypted queries | DNS-over-HTTPS from your browser | Sent through their server |
| Sign-up or limits | None | Daily caps or an account for email checks |
Tips
- Use All first when you do not know what a domain has. It runs 11 queries at once and hides empty types.
- An SRV lookup needs the service prefix. Choose SRV and the tool offers common ones such as _sip._tls and _autodiscover._tcp.
- To see where an A record's address is hosted, open it in the IP lookup. If you are documenting the records, the JSON formatter tidies exported zone data.
Questions
How do I check a domain's DNS records?
Type the domain, pick a record type or All, and press Look up. Each record appears with its TTL and a short explanation of what it does.
Why do Cloudflare and Google give different answers?
Usually a recent change that one resolver has cached and the other has not refreshed yet. CDNs and load balancers also return different IPs on purpose depending on who asks.
How long does DNS propagation take?
Up to the old record's TTL. With a TTL of 3600 seconds, most resolvers pick up the change within an hour. Some ISP resolvers ignore low TTLs and hold records longer.
What does NXDOMAIN mean?
The name does not exist. Either nobody has created that record, or the domain itself is not registered or has no working name servers.
What is the SPF 10 lookup limit?
RFC 7208 allows an SPF check to trigger at most 10 DNS lookups, counting include, a, mx, ptr, exists and redirect, nested ones included. Going over makes SPF fail with a permanent error.
Can I do a reverse DNS lookup?
Yes. Type an IPv4 or IPv6 address and the tool builds the in-addr.arpa or ip6.arpa name and queries its PTR record.