TXT · Text & Data tools

DNS Lookup

Domain or IP
Record type
Answer
Enter a domain and press Resolve
0records0 msquery timeCloudflare DoHresolver

Check DNS records from the browser

The query goes straight from the page to a public DNS-over-HTTPS resolver: Cloudflare’s cloudflare-dns.com or Google’s dns.google JSON API. The answer table shows each record’s name, remaining TTL, type, and data, the same information dig prints, without needing a terminal. Domain, record type, and resolver live in the URL, so a lookup can be shared as a link.

Record types and what they answer

  • A / AAAA: the IPv4 and IPv6 addresses a hostname points to. The first thing to check when a site is unreachable.
  • CNAME: the alias target. A hostname with a CNAME cannot have other record types, which is why CNAMEs at a zone apex break things.
  • MX: mail servers and their priorities. Lower priority values are tried first.
  • TXT: verification strings, SPF policies, DKIM keys, DMARC policies. Long TXT records arrive split into quoted segments; receivers join them.
  • NS: the authoritative nameservers for the zone. If these are wrong, nothing else matters.
  • SOA: zone metadata, including the serial number that increments on changes, useful for confirming a zone actually updated.
  • SRV: service locations (_service._proto.name) with port and priority, still used by SIP, XMPP, and Minecraft.
  • CAA: which certificate authorities may issue certificates for the domain.
  • PTR: reverse DNS. Enter a plain IPv4 address like 1.1.1.1 and the reverse name is built automatically.

TTL and propagation

The TTL column shows how many seconds the resolver will keep serving its cached copy. After changing a record at your DNS host, resolvers keep answering with the old value until their cached TTL runs out. Querying both Cloudflare and Google and comparing answers is a practical propagation check: when both return the new value, most of the internet sees it too. Repeating a query also shows the TTL counting down, which confirms you are watching a cache rather than the authoritative server.

Response status

The status badge shows the DNS response code. NOERROR with records is a normal answer. NOERROR with an empty answer means the name exists but has no records of that type, common when querying AAAA for an IPv4-only host. NXDOMAIN means the name does not exist at all. SERVFAIL usually points at a problem on the authoritative side, including failed DNSSEC validation. The DNSSEC badge appears when the resolver cryptographically validated the answer chain.

Limits

Both resolvers answer from their own caches, so this shows the public view of a zone, not the authoritative one; to query a specific nameserver directly you still need dig @ns1.example.com. And because the resolver is external, a lookup requires a network connection, unlike the rest of the workbench.

Frequently Asked Questions

It sends your query to Cloudflare's or Google's public DNS-over-HTTPS API and shows the returned records with their names, TTLs, types, and data, plus the response status and whether the answer passed DNSSEC validation.

A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, and PTR. For PTR, enter an IPv4 address directly and it is converted to the in-addr.arpa reverse form automatically.

Caching. Each resolver serves answers from its own cache until the record's TTL expires, so a recently changed record can show the new value on one resolver and the old value on the other. Comparing both is a quick propagation check.

The domain name does not exist at all. It is different from a NOERROR response with no records, which means the name exists but has no records of the requested type.

The page sends one HTTPS request to cloudflare-dns.com or dns.google, the same public JSON APIs the resolvers document for developers. No other server is involved.

Explore Our Tools

Browse all tools