Free DNS lookup

Eight record types in a single pass

Enter a domain and the page asks Cloudflare's public resolver, 1.1.1.1, for A, AAAA, CNAME, MX, NS, SOA, TXT and CAA records. The query is sent over DNS-over-HTTPS from your browser, so it reflects what a public resolver returns to you, and not an answer taken from the zone's own servers. Each result is printed in a dig style: the name, the remaining TTL, the type and the data. Types without answers are left out, which is informative in itself.

Together these answer most "why is this not working" questions. A and AAAA decide where web traffic goes. CNAME makes one name an alias for another. MX routes mail. NS says which servers are authoritative. TXT carries SPF, domain verification and DMARC policy. CAA limits which authorities may issue certificates.

Reading TTL and why answers differ

The number beside each record is the time, in seconds, that this resolver may still cache it. Run the lookup twice; if the second shows a lower number, you saw the cached copy counting down. Different resolvers hold different copies, so Google, Cloudflare and your ISP can disagree for hours after an edit. That is the whole story behind "propagation": nothing is pushed, caches simply expire.

Plan changes around the TTL. If a record has a TTL of 86400 (one day) and you want to move a site tonight, lower the TTL to 300 first, wait at least a day for the old long-lived copies to run out, make the change, then raise it again afterwards. Rushing the order produces a day of half your visitors on the old server.

Records people misread

Some patterns recur in support tickets:

• A CNAME cannot sit at the zone apex next to the SOA and NS records. Providers get around that with ALIAS, ANAME or flattened CNAME records, which appear to a resolver as ordinary A records.
• A CNAME on a name that also has an MX or TXT record breaks them, because the alias takes over every type for that name.
• The SOA serial is usually a date plus a counter, such as 2026110601. If it does not change after an edit, the edit never reached the primary nameserver.
• NS records at the registrar and in the zone must agree. A mismatch ("lame delegation") causes intermittent failures that look random.
• A CAA record such as 0 issue "letsencrypt.org" stops any other authority from issuing certificates. Forgetting it is a standard cause of a certificate order that fails after a provider change.
• A TXT value longer than 255 characters has to be split into several quoted strings, which many dashboards do automatically.

What this lookup cannot tell you

It does not talk to the authoritative servers, so a brand-new change can be invisible for as long as the TTL. It does not show DNSSEC validation, and DNS-over-HTTPS can be blocked by some corporate networks, in which case the page suggests running dig in a terminal (the command is printed below the tool). It also reflects a single resolver: it will not catch a nameserver that answers wrongly for only some clients or from some countries.

Watching records instead of looking at them

A DNS monitor repeats this lookup on a schedule and compares the answer with the values you expect for A, AAAA, CNAME, MX, NS or TXT records. An unexpected change opens an incident and the alert shows what was found, which turns a silent hijack or an accidental deletion into a notification. DNS monitoring starts on the Starter plan; see DNS monitoring for how expected values are matched. The domain expiry checker is the companion for the registration side.