DNS Lookup

Query live DNS records for any domain straight from your browser. Pick a record type — A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV — and a resolver, and see the answers with their TTLs and the response status code. Lookups run over DNS-over-HTTPS against Google or Cloudflare, so there's no server in between and nothing to install.

How to use the DNS Lookup

Type a domain name, choose the record type you want, pick Google or Cloudflare as the resolver, and hit Look up (or press Enter). The tool queries that resolver over DNS-over-HTTPS and shows each matching record with its name, type, TTL in seconds, and data — IP addresses for A and AAAA, mail servers for MX, text strings for TXT, and so on. The response status (NOERROR, NXDOMAIN, SERVFAIL…) tells you whether the name resolved.

If you paste a full URL, the scheme and path are stripped automatically so https://example.com/page becomes example.com. Switching the record type or resolver re-runs the query immediately, which makes it easy to compare what two resolvers return or to walk through a domain's record types. When there are no answer records but an authority section is present — common for NXDOMAIN or for types a name doesn't publish — that section is shown instead so you can see the SOA the zone returned.

DNS records and DNS-over-HTTPS

The Domain Name System is the directory of the internet: it maps human-readable names to the data clients need to reach a service. Different record types carry different data. An A record holds an IPv4 address and AAAA an IPv6 address; CNAME aliases one name to another; MX lists the mail servers for a domain; TXT stores arbitrary text, which is where SPF, DKIM, and domain-verification strings live; NS names the authoritative servers for a zone; SOA holds the zone's administrative metadata; CAA declares which certificate authorities may issue certificates; and SRV advertises the host and port for a service. Looking these up is the first step in diagnosing almost any connectivity, email, or certificate problem.

Every record also carries a TTL — a time-to-live in seconds that tells resolvers how long they may cache the answer. TTLs explain why DNS changes aren't instant: after you edit a record, resolvers that already cached the old value keep serving it until the TTL expires. A low TTL means changes propagate quickly but generates more queries; a high TTL is efficient but makes changes slow to take effect. Seeing the TTL in a lookup tells you how long to expect a stale answer to linger.

DNS-over-HTTPS (DoH) is what makes a browser-based lookup possible. Traditional DNS uses UDP on port 53, which web pages can't speak; DoH wraps the same queries in ordinary HTTPS requests to a resolver like Google's dns.google or Cloudflare's cloudflare-dns.com, which return the answer as JSON. That means this tool talks directly to a public resolver from your browser with no intermediary server — your query goes to Google or Cloudflare and the result comes straight back. Because DoH is encrypted, the lookup is also private from the network between you and the resolver, though the resolver itself naturally sees what you ask.

Common use cases

  • Debugging propagation. Check whether a record change has taken effect and see its TTL.
  • Email setup. Verify MX records and inspect SPF, DKIM, and DMARC strings in TXT records.
  • Certificate issues. Read CAA records to see which authorities are allowed to issue certs.
  • Comparing resolvers. See whether Google and Cloudflare return the same answer for a name.

Frequently asked questions

Which record types can I query?
A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV, PTR, and HTTPS. The resolver returns the records of that type published for the name, along with the response status code.

How does a lookup work in the browser?
It uses DNS-over-HTTPS. Browsers cannot send classic DNS queries on port 53, so the tool makes an HTTPS request to Google or Cloudflare's public DoH endpoint, which returns the answer as JSON. There is no server of ours in between.

What does the status mean?
It is the DNS response code. NOERROR means the query succeeded (it may still have zero answers if the type is not published); NXDOMAIN means the name does not exist; SERVFAIL means the resolver had a problem; REFUSED means it declined to answer.

Why do I sometimes see no answers but an authority section?
When a name has no records of the requested type, the resolver often returns the zone's SOA record in the authority section instead. The tool shows it so you can see which zone answered and its negative-caching TTL.

Is my query private?
The lookup goes directly from your browser to Google or Cloudflare over encrypted HTTPS, so the network in between cannot read it. The resolver you pick does see the name you query, as any DNS resolver would.