Free tool · No sign-up
DNS Lookup
See any domain as a map: how the internet finds it, where its servers are, whether its email can be forged, and what every record means.
Try , , . Every record, read live from public DNS. Need mail, blacklist and website checks too? Run the full Domain Health Check.
Live answers
Each lookup asks public DNS at that moment, so you see what the internet sees now, not a cached copy.
Check a change
Moved a website or mail provider? Confirm the new records are published before you switch anything off.
Need more than a lookup?
Our network team designs and runs DNS, connectivity and the infrastructure behind it.
Guide
DNS, explained in four ideas
- 01
DNS is the internet's address book
People remember names; networks route to numbers. When you type a domain, a resolver looks up the number behind it, usually in a few milliseconds.
- 02
Each record has one job
A and AAAA records point to the website, MX to the mail servers, NS to the servers that answer for the domain, and TXT and CAA carry policies such as SPF, DMARC and certificate rules.
- 03
Answers are cached
Every answer carries a TTL, a time to live. Resolvers reuse it until it runs out, which keeps the internet fast and is why a change can take minutes or hours to reach everyone.
- 04
Signatures and policies stop forgery
DNSSEC signs records so they cannot be faked on the way. SPF, DKIM and DMARC tell mail receivers how to spot email pretending to be from your domain, and what to do with it.
Record types at a glance
| Type | What it does | Example |
|---|---|---|
| A | Points a name to an IPv4 address: where the website or service lives. | example.com → 192.0.2.10 |
| AAAA | The same for IPv6, the newer, longer address format. | example.com → 2001:db8::10 |
| CNAME | Makes one name an alias of another. Common for www and for CDNs. | www → example.cdn.net |
| MX | Names the servers that receive the domain's email, in priority order. | 10 mail.example.com |
| NS | Names the servers that hold the domain's records and answer for it. | ns1.provider.com |
| TXT | Free text, used for SPF, DMARC and proofs of ownership for services like Google or Microsoft. | v=spf1 include:_spf.google.com -all |
| CAA | Says which certificate authorities may issue HTTPS certificates for the domain. | 0 issue "letsencrypt.org" |
| SOA | The zone's start of authority: primary server, admin contact and refresh timings. | ns1.provider.com admin.example.com 2026… |
Questions people ask
What is DNS propagation, and how long does it take?
After you change a record, resolvers that cached the old answer keep using it until its TTL runs out. With a TTL of 5 minutes, everyone sees the change within about 5 minutes; with 24 hours, it can take a day. Lowering the TTL a day before a planned move makes the switch fast.
Why do different resolvers show different IP addresses for the same site?
Large sites use content delivery networks such as Cloudflare, Akamai or Amazon CloudFront, which answer with the server nearest each resolver. Different addresses for a website are normal. Different answers for MX, NS or TXT records usually mean a change is still spreading.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send your mail. DKIM adds a signature that proves a message came from you and was not altered. DMARC ties them together: it tells receivers what to do when both checks fail, and sends you reports. You need all three to stop others sending email as your domain.
My DMARC policy says quarantine. Why can spoofed mail still get through?
Check the pct tag. pct=0 applies the policy to none of the failing mail, so nothing is quarantined. Also check that the policy is not p=none, which only monitors. A policy protects you only when it is quarantine or reject and pct is above zero, ideally 100.
Should I turn on DNSSEC?
Usually yes. DNSSEC lets resolvers verify that records are genuine, which blocks attacks that redirect visitors or mail by forging DNS answers. Most DNS providers, including Cloudflare, switch it on in a few clicks; you then add the DS record they give you at your registrar.
What is a CAA record, and do I need one?
A CAA record names the certificate authorities allowed to issue HTTPS certificates for your domain. Every other authority must refuse, which makes a fraudulent certificate much harder to obtain. It costs nothing and takes two lines.
Does this tool scan or change anything?
No. It reads only public DNS records, the same answers any resolver gets, plus public data about which network announces each address. Nothing is scanned, probed or changed.
Let's build what's next
A more resilient tomorrow starts with you & us.
Book 20 minutes with an engineer to talk through your infrastructure, security and transformation goals, or send us a message and we will come back to you.
Or reach us directly: 1800 569 0101 · [email protected] · WhatsApp
Same challenges.
Brighter possibilities.