DNS Lookup Tool
Query A, AAAA, MX, TXT, CNAME, NS, CAA, and SOA records for any domain. Inspect SPF, DKIM, and DMARC. No signup, instant results.
What it checks
Every record type that matters.
One lookup, every record - addresses, mail, text, aliases, nameservers, and CAs.
A & AAAA records
IPv4 and IPv6 addresses the domain resolves to - the endpoints your visitors actually connect to.
MX records
Mail exchange records and their priorities. Required for receiving email at the domain - missing or wrong MX is invisible until someone tries to email you.
TXT records (SPF, DKIM, DMARC)
Free-form text records that hold your email authentication policy. SPF lists who can send mail; DKIM holds signing keys; DMARC tells receivers what to do with failures.
CNAME records
Aliases that point one name at another. Common for www, CDN endpoints, and SaaS subdomain verification. Can't coexist with other records on the same name.
NS & SOA records
The authoritative nameservers for the zone, and the Start of Authority record that holds serial number, refresh, and minimum TTL for the zone.
CAA records
Certification Authority Authorization - controls which CAs are allowed to issue SSL certs for the domain. A small but important guardrail against cert mis-issuance.
How it works
From domain to full record set in about a second.
No dig, no nslookup - just paste and read.
Paste a domain
Apex or subdomain. No scheme, no path - just the hostname (example.com, mail.example.com).
Pick a record type
Default is ALL, which queries the common types in parallel. Pick a single type when you're debugging a specific signal like SPF or MX.
Read the report
You'll see every record returned, grouped by type, with values and TTLs - everything you need to confirm DNS is set up correctly.
Why DNS matters
If DNS is broken, nothing else gets a chance.
Every visit, every API call, every email starts with a DNS lookup. A bad record is invisible until everything stops working.
Reliability
A single bad NS delegation, a missing A record, or a fat-fingered IP can take a site fully dark. And because DNS caches everywhere, it can also keep it dark long after you fix the root cause.
Speed & failover
TTL is the speed dial of resilience. Low TTLs let you fail over in seconds; high TTLs lower DNS query load but pin you to whatever's published. Picking the right TTL is a real operational call, not a default.
Email deliverability
SPF, DKIM, and DMARC all live in DNS. Get them right and your mail lands in the inbox; get them wrong and you're in spam - or rejected outright. Gmail and Yahoo now require DMARC for any bulk sender.
Reference
Common DNS record types, explained.
What each record does, and when it matters.
A / AAAA
Maps a name to an IPv4 (A) or IPv6 (AAAA) address. The foundation of every web request. Multiple records mean round-robin or geo-balanced.
MX
Mail exchange. Points incoming mail at a mail server. Lower priority number = preferred. Wrong MX = silently lost inbound email.
TXT
Arbitrary text. The kitchen drawer of DNS - SPF, DKIM, DMARC, domain verification tokens (Google, Microsoft, Stripe, etc.) all live here.
CNAME
Canonical name. Aliases one host to another. Can't be set on the apex domain - that's what ALIAS or ANAME records are for at supporting providers.
NS
Nameserver. Delegates a zone to a set of authoritative nameservers. The first thing recursive resolvers find when they walk down the DNS tree.
SOA
Start of Authority. Zone metadata - serial number, primary nameserver, refresh intervals, and the minimum TTL for negative caching.
CAA
Certification Authority Authorization. Whitelists CAs that can issue certs for the domain. Every CA is required to check this before issuance.
TTL
Time-to-live in seconds. How long resolvers and clients cache a record. Low TTL (60-300s) = fast failover; high TTL (3600+) = less DNS load, slower changes.
FAQ
Frequently asked questions.
Quick answers about the lookup and how to use it well.
Why don't I see the changes I just made?
DNS is cached aggressively. Your registrar may take a minute to publish, recursive resolvers along the path cache for the record's TTL, and your local OS caches on top of that. If the new value is right at the authoritative nameservers, propagation is just a wait.
What's the difference between A and AAAA?
A returns an IPv4 address; AAAA returns an IPv6 address. Modern clients prefer AAAA when both exist. Missing AAAA on an IPv6-capable network can fall back through Happy Eyeballs - usually fine, but a real config issue.
How do I check my SPF / DKIM / DMARC?
Look up TXT for the apex (for SPF and DMARC at _dmarc.example.com) and the DKIM selector (selector._domainkey.example.com). Wrong or missing values are the most common cause of mail going to spam.
Why are my results different from another DNS tool?
Recursive resolvers can return different answers depending on what they have cached, where they're geographically, and whether your provider does GeoDNS. This tool queries fresh and shows what an authoritative answer looks like right now.
How often should I check DNS?
Any time you change records, change registrars, or move providers. For continuous coverage, SiteTrak monitors DNS records and alerts on unexpected changes - including the kind of MX or NS change that signals a registrar takeover.
Is this tool really free?
Yes - no signup, no email harvesting. We rate-limit per-IP to keep it fast for everyone. The paid product is the monitoring side: scheduled DNS checks and change alerts.
Keep going
Other free tools you'll like.
Run one once, or set up SiteTrak and never run them again.
HTTP Header Inspector
Inspect response headers, CDN, cache configuration, and security policy for any URL.
SSL / TLS Checker
Inspect the certificate, expiry, issuer, and TLS version for any domain.
Redirect Checker
Trace every hop in a redirect chain, with status codes and final destination.
Security Headers
Grade your site's security headers (HSTS, CSP, X-Frame-Options) and get a letter score.