DNS Lookup

How the DNS Lookup works

DNS lookup: what each record type does

dig and nslookup do this from a terminal, but they are not always to hand and their output takes practice to read. This tool asks a public DNS-over-HTTPS resolver the same questions and lays the answers out as a table, with the record type explained and the values interpreted: an MX line becomes a priority and a mail host, an SOA becomes the primary server, the contact address and the refresh timers, a CAA becomes "only Let's Encrypt may issue".

Record types. A and AAAA are the IPv4 and IPv6 addresses the name resolves to. CNAME says the name is an alias for another name; the tool follows the chain and shows each hop. MX lists the mail exchangers by priority, lowest first. NS names the authoritative servers for the zone. TXT holds free text and is where SPF, DKIM, DMARC, domain-verification tokens and the like live; each is labelled by what it looks like. SOA holds the zone's serial number and timers. CAA restricts which certificate authorities may issue for the name. SRV points a service such as _sip._tcp at a host and port. PTR is the reverse lookup for an IP address — type the address and the tool builds the in-addr.arpa or ip6.arpa name for you.

TTL. Every record carries a time-to-live in seconds, shown alongside as a human duration. A low TTL such as 300 means changes propagate within minutes; a high one such as 86400 means a day. If you are about to migrate a service, lower the TTL well in advance and this is where you check that the lower value has taken effect.

DNSSEC. The resolver reports whether the answer was validated with DNSSEC. A validated answer is shown as such; an unsigned zone is normal for most domains and is simply noted.

Subdomains and the apex. Look up www.example.com and example.com separately — they are different names with different records, and the most common "the site works with www but not without" problem is exactly that. The apex cannot be a CNAME, so providers use ALIAS or ANAME records that appear here as ordinary A records.

Not found. NXDOMAIN means the name does not exist at all. An empty answer with status NOERROR means the name exists but has no record of that type — a domain with A records but no AAAA, say. The tool reports which, since they mean different things when debugging.

Propagation. This tool asks one resolver, which caches. If you changed a record seconds ago you may see the old value until the TTL expires; that is DNS working as designed, not a failure. The authoritative servers listed under NS always have the current answer.

Related tools