DNS Lookup
Free DNS lookup. See every DNS record for a domain in one query — A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY, SVCB and HTTPS — decoded and readable.
Every record, one query
Enter a domain and this queries thirteen record types at once — A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY, SVCB and HTTPS — then shows exactly what's published. No guessing which type to pick, and no running the same lookup a dozen times.
Record types with nothing published are collapsed by default, so what you see is what actually exists.
Records are decoded, not dumped
Public resolvers often return newer record types in RFC 3597 "unknown record" format — a length followed by raw hex, like \# 15 00 05 69 73 73 75 65.... That's technically the record, and it's useless to read.
We decode them into their proper presentation form, so a CAA record reads 0 issue "pki.goog" and an HTTPS record reads 1 . alpn="h2,h3" ipv4hint=104.16.132.229 — the ALPN protocols, ports, and IP hints spelled out rather than left as bytes.
Lookup vs propagation vs health
Three different questions, three different tools:
- This page asks what exists? — one resolver, every record type. The reference view.
- The propagation checker asks has my change reached the world? — one record type, 14 resolvers, compared against each other.
- The health check asks is any of this wrong? — the same records, but read for problems and reported as findings.
FAQ
What is a DNS lookup?
Asking a DNS resolver what records are published for a name. Every domain has a set of records — where its website lives (A/AAAA), where its email goes (MX), which nameservers are authoritative (NS), and text records carrying things like SPF policies. A lookup returns whichever of those you ask for.
Why does a record type show "none published"?
Because the name exists but has no record of that type — which is normal. Most domains have no SRV records, and most aren't DNSSEC-signed so they have no DS or DNSKEY. That's different from the name not existing at all, which returns NXDOMAIN for every type and is called out explicitly.
Why don't you show TTL values?
The DNS-over-HTTPS responses these queries use don't consistently expose TTLs, and a resolver's remaining TTL reflects how long it has had the record cached rather than what the zone publishes. Showing a number that means something different from what people assume would be worse than showing none. To reason about caching, see the TTL glossary entry.
Does this show subdomains?
No — DNS has no way to list the names inside a zone (that's what zone transfers were for, and they're almost universally blocked now). You can look up any subdomain directly by entering it, for example www.example.com or mail.example.com.
Why do my results differ from another tool?
Usually caching. Each resolver holds its own copy until the record's TTL expires, so a recently-changed record can look different depending on who you ask. That's exactly what the propagation checker is for — it asks 14 resolvers at once and shows you the disagreement.
Is PTR included?
No, because PTR is keyed on an IP address rather than a domain name. Use the reverse DNS lookup and enter an IP.
Background reading
See the DNS Records Explained guide for what each type does, and the DNS glossary for the terminology.