DNS Checker — look up any domain's live records
Query A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records straight from the authoritative nameservers.
Free and instant — results appear in seconds. No sign-up, no limits, and nothing you type is stored.
A DNS lookup answers a narrow question: what do the authoritative nameservers for this domain currently say? Not what your laptop remembers, not what your ISP's resolver cached forty minutes ago — what the servers responsible for the domain are publishing at this moment.
That distinction is the whole reason this tool is useful. When you change a record, your own machine is the last place that will tell you the truth about it, because it is holding an old answer until the TTL expires. Querying from somewhere else, over a connection that has never cached your domain, tells you whether the change actually landed.
Enter a domain above and pick a record type, or leave it on "All records" to see everything at once.
Reading a real result
Run a lookup on a domain that hosts both a website and email, and you will typically get something like this:
A 93.184.216.34 TTL 3600
MX mail.example.com priority 10, TTL 3600
MX mail2.example.com priority 20, TTL 3600
NS ns1.registrar.com TTL 86400
NS ns2.registrar.com TTL 86400
TXT v=spf1 include:_spf.example.net ~all TTL 3600
SOA ns1.registrar.com hostmaster.example.com serial 2024051401What each line is telling you:
The A record is the IPv4 address a browser connects to. One A record means one server. Several means the domain is load-balanced across addresses, and the resolver picks between them.
The two MX records are mail servers with priorities 10 and 20. Lower wins. Mail goes to mail.example.com first; mail2 only receives if the first is unreachable. A common misconfiguration is giving both the same priority when you meant them to be primary and backup.
The NS records name the servers that hold the authoritative zone. If these do not match what your registrar shows, you are editing DNS in one place while the internet reads it from another — which is the explanation for a surprising proportion of "my changes aren't working" problems.
The TXT record here is an SPF policy. ~all at the end means unlisted senders should be treated as suspicious but not rejected outright.
The SOA serial is a version number. Most operators format it as a date plus a counter, so 2024051401 reads as the first edit made on 14 May 2024. If you changed a record and the serial has not moved, the zone has not been reloaded.
The TTLs are the caching instruction, in seconds. 3600 means resolvers may hold that answer for an hour before asking again.
What each record type does
A maps a hostname to an IPv4 address. This is the record that decides where a browser goes.
AAAA does the same for IPv6. Its absence is not an error, but IPv6-only clients — increasingly common on mobile networks — reach you through a translation layer instead of directly.
CNAME points one hostname at another. A CNAME cannot coexist with any other record on the same name, which is why www can be a CNAME but the bare domain usually cannot.
MX names the mail servers for the domain, each with a priority. Lower numbers are tried first.
TXT holds arbitrary text, which in practice means SPF policies, DKIM keys, DMARC policies and domain-ownership verification strings.
NS delegates the domain to its authoritative nameservers.
SOA carries zone metadata: the primary nameserver, an administrative contact, a serial number and refresh timers.
CAA restricts which certificate authorities may issue certificates for the domain. Most domains have none, which means any CA may issue.
Why your changes have not appeared yet
DNS is a caching system, and caching is the point — it is what keeps the root servers from melting. The cost is that changes propagate at the speed of the TTL you set before you made the change.
If a record had a TTL of 86400 and you edit it, resolvers that fetched the old value five minutes ago will keep serving it for the next 23 hours and 55 minutes. Nothing you do afterwards shortens that. This is why the standard migration sequence is: lower the TTL to 300, wait for the old TTL to expire, then make the actual change, then raise the TTL again.
This tool queries the authoritative servers directly, so it shows the new value immediately even while cached copies elsewhere are still stale. If the tool shows the new record and your browser does not, you are looking at a cache, not a problem.
Common misconfigurations worth checking
- Nameservers that disagree with the registrar. You are editing a zone nobody reads.
- A CNAME on the apex domain. Not valid in standard DNS. Providers offer ALIAS or ANAME records as a workaround.
- Multiple SPF TXT records. Only one is permitted. Two makes the check fail outright rather than merging.
- MX pointing at a CNAME. Explicitly forbidden by the specification, and some mail servers refuse it.
- Trailing dots.
example.comandexample.com.mean different things in a zone file; getting it wrong appends the domain to itself.
Frequently asked questions
Why does this tool show a different result than my computer?
Your computer and your ISP hold cached copies of DNS answers, and they keep serving those copies until the TTL expires. This tool queries the authoritative nameservers directly, which is why it sees changes before you do. The difference is expected during the first few hours after an edit.
How long do DNS changes take to propagate?
It depends entirely on the TTL that was set on the record before you changed it, not the new one. A record with a TTL of 3600 can be cached for up to an hour after the edit. If the old TTL was 86400, the wait can be a full day. Lower the TTL well ahead of any planned migration.
My domain shows no MX records. Is that a problem?
Only if you want to receive email on that domain. Without MX records, most sending servers will fall back to the A record and try to deliver there, and many will simply reject the message. If you use a mail provider, they will supply the MX values to add.
What does the priority number on an MX record mean?
It sets the order in which sending servers try your mail hosts. The lowest number is attempted first. If two records share a priority, load is split between them. Backup mail servers are given a higher number so they only receive mail when the primary is unreachable.
Should I add a CAA record?
It is a low-effort improvement. A CAA record lists which certificate authorities are permitted to issue certificates for your domain, so a CA that receives a fraudulent request for your name is obliged to refuse it. Add the authority you actually use, and remember to update it if you switch.
Can I look up a subdomain?
Yes. Enter the full hostname, such as blog.example.com or mail.example.com. Subdomains frequently have their own A, CNAME or MX records that differ from the parent domain.
Reviews
No reviews yet. If this tool solved something for you, yours would be the first — and it helps other people decide whether it is worth their time.