DNS lookup

What this DNS lookup does and where the answers come from

DNS turns names into the addresses and settings the internet runs on: which server hosts a website (A and AAAA records), which servers accept email (MX), who may send mail for a domain (SPF in TXT), which certificate authorities may issue certificates (CAA) and which nameservers are in charge (NS and SOA). This tool asks a public recursive resolver the same question your computer asks when you open a website, and shows the full answer with its TTL — the number of seconds that answer may be cached.

Your browser talks directly to the resolver over DNS-over-HTTPS: Cloudflare (1.1.1.1) and Google (8.8.8.8) through their JSON APIs, and Quad9 (9.9.9.9) in the raw binary DNS format, which the page builds and decodes itself. Nothing passes through our servers and nothing is logged by us. The resolvers see the name you look up, exactly as they would if you used them as your normal DNS.

ALL mode sends a dozen queries in parallel — A, AAAA, CNAME, MX, NS, SOA, TXT, CAA, HTTPS, DS, DNSKEY and the DMARC record at _dmarc — then probes common SRV services and runs the email check. Choosing a single type is faster and shows the complete answer for just that record, including any CNAME chain the resolver followed.

DNS record types explained

A CNAME cannot sit at the root of a domain alongside MX and NS records, which is why DNS hosts offer “CNAME flattening” or ALIAS records for example.co.uk itself. If a name is a CNAME, the tool shows the alias chain above the final addresses.

Checking SPF, DMARC and DKIM for email deliverability

Since 2024 Gmail, Yahoo and Microsoft reject or junk bulk mail from domains without proper authentication, and even small businesses on Microsoft 365 or Google Workspace see invoices land in spam when a record is wrong. The email card checks the four things receivers look at:

• MX — at least one mail server, or a deliberate Null MX (0 .) for domains that never receive mail.
• SPF — exactly one v=spf1 record. Two records is a permanent error that fails every message. The tool follows every include: and redirect= to count DNS lookups against the hard limit of 10; go over it and SPF fails even though the record looks fine. It also flags +all, ?all and the deprecated ptr mechanism.
• DMARC — the policy at _dmarc.yourdomain. p=none only monitors; quarantine and reject actually protect your name from spoofing. Without a rua= address nobody receives the reports.
• DKIM — selectors can’t be listed from DNS, so the tool tries 28 common ones (Google google, Microsoft selector1/selector2, Mailchimp k1 and others) and reports the RSA key length. “Not found” doesn’t prove DKIM is missing: read the s= tag in a received message’s DKIM-Signature header and look up selector._domainkey.yourdomain as a TXT record.

MTA-STS, TLS-RPT and BIMI are shown as optional extras. This is a DNS check: it can’t send a test message or query spam blocklists.

DNS propagation, TTLs and comparing resolvers

There is no push in DNS. When you change a record, resolvers keep serving the old answer until its TTL runs out, then fetch the new one. So “propagation” really means “caches expiring”. Compare all 3 asks Cloudflare, Google and Quad9 the same question and highlights any resolver that disagrees. If they differ straight after a change, look at the TTLs: the largest one is the longest you may have to wait. Lower the TTL to 300 seconds a day before a planned migration and changes will spread within minutes.

Different answers are not always a problem. CDNs such as Cloudflare, Fastly and Akamai, and geo-DNS services, hand out different addresses depending on where the resolver is, so A and AAAA records for big sites often differ legitimately while MX, TXT and NS should match. TTLs also differ between resolvers because each cached the record at a different moment and counts down independently.

Your broadband provider’s resolver (BT, Sky, Virgin Media, Vodafone, EE) may lag behind these three, and so can your own computer’s cache. On Windows, ipconfig /flushdns clears it; on a Mac, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.

DNSSEC, NXDOMAIN, SERVFAIL and other results

NXDOMAIN means the name doesn’t exist at all — a typo, an unregistered domain or missing nameservers; a WHOIS lookup tells you whether the domain is registered. NOERROR with no records (NODATA) means the name exists but has nothing of that type, which is normal: most domains have no SRV or HTTPS records. SERVFAIL means the resolver couldn’t get a trustworthy answer. When that happens the tool automatically repeats the query with DNSSEC checking disabled; if the name then resolves, DNSSEC is broken — almost always a DS record at the registrar that no longer matches the zone’s key after a move between DNS hosts. Validating resolvers treat such a domain as down.

The DNSSEC badge comes from the resolver’s AD (authenticated data) flag. “Signed & validated” means a DS record exists at the parent and the signatures check out; “not enabled” simply means the domain is unsigned, as most .co.uk domains still are. For reverse DNS, type an IP address: the tool builds the in-addr.arpa or ip6.arpa name for you. PTR records are controlled by whoever owns the address block — usually your ISP or host — which you can find with WHOIS; your own public address is on What is my IP.

Frequently asked questions