DNS checker

Use this DNS checker to read records and TTLs for a domain. Compare public and authoritative answers, then review mail, alias and DNSSEC findings.

Free, no account. Thirty DNS checks per hour. Results are cached for 30 seconds.

A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in one run. Public IP addresses use PTR. A pasted URL uses only its hostname.

Optional SRV lookup

Use a full _service._tcp or _service._udp name. Leave it empty to skip SRV.

A DNS checker reads the records connecting a domain to websites, email and other services. This checker asks three public resolvers and the authoritative name servers for eight record types, with TTLs and DNSSEC signals. It explains mail policies, broken aliases, delegation and CAA. Failed checks remain unconfirmed. Public IP addresses use reverse DNS.

How to use this tool

Enter your domain
Use an exact hostname or paste a URL. Public IPv4 and IPv6 addresses run a PTR lookup. Expand the optional field to add a full SRV service name. Each run stops within ten seconds.
Read each record type
A and AAAA identify IP addresses, MX names mail servers, NS lists name servers, TXT holds text, CNAME is an alias, SOA describes the zone and CAA controls certificate issuance. Every returned record shows its TTL in seconds.
Compare the evidence
Google, Cloudflare and Quad9 are compared with up to two authoritative servers. AD reports the resolver’s authentication signal, and DS presence is checked separately. Neither signal is a full DNSSEC validation. Failed authority checks leave comparisons unconfirmed.
Act on owner findings
Review aliases whose target does not exist, MX hosts that are aliases and parent/child NS differences. SPF and DMARC findings link to their dedicated checkers. CAA is compared with the live certificate issuer when one short TLS handshake succeeds; unfamiliar issuers remain unconfirmed.

Questions before you start

It asks three public resolvers from our server and samples up to two authoritative servers. Use the DNS propagation checker to compare 21 operators. Anycast and CDN routing can give visitors elsewhere different answers.

Not every domain needs every type. Missing AAAA is fine when the service only uses IPv4. No-record and nonexistent-name responses are labelled separately from failures. A failed lookup cannot confirm that a record is missing.

CAA controls new issuance and renewal. A policy change does not invalidate an existing certificate. We follow CAA inheritance and compare known issuer names, but leave issuer-specific parameters and unknown critical properties unconfirmed. This is separate from certificate trust validation.

The link contains only the domain or IP and optional SRV query. Opening it fills the form without running it. Copy the JSON result to keep the observed answers and timestamp. Results are cached for 30 seconds and each IP can run 30 checks per hour.

Related tools

  • DNS propagation checker

    Use this DNS propagation checker to compare 21 public resolvers with authoritative answers or an expected value. Review disagreements and follow changes.

  • MX lookup

    Use this MX lookup to inspect mail server priorities, IP addresses, provider hints and forward-confirmed reverse DNS. Review routing findings and a bounded public SpamCop check.

  • SPF record checker

    Use this SPF record checker to expand includes and inspect candidate IP ranges. Add your public sending IP to trace mechanism order, macros and the DNS lookup limits.

Check your business in AI answers

Technical checks help you repair a page. The free AI visibility scan shows the answers checked for your business and what to work on next.

Run the free AI visibility scan