DNS Records Checker: Look Up A, MX, NS, TXT and More
Enter a domain to see its live DNS records from Google Public DNS and Cloudflare. The checker also reviews email records (SPF, DMARC, MX), DNSSEC and name servers, and flags common mistakes.
Try: · ·
“Compare both” helps spot a change that is still spreading.
How to use the DNS checker
- Type a domain such as
example.com. You can also paste a full URL; the checker keeps only the host name. - Pick All for a full report, or a single record type. Paste an IP address to get its reverse DNS (PTR) name.
- Choose a resolver. Use Compare both after you change a record to see whether Google and Cloudflare already return the new value.
- Read the checks below the records. Red items need fixing, yellow items are worth a look.
- Copy the report or share the link. The link opens the same lookup, so you can bookmark it for a domain you manage.
DNS record types explained
| Type | What it does | Example value |
|---|---|---|
| A | Points a name to an IPv4 address (the server that answers web requests). | 93.184.215.14 |
| AAAA | Points a name to an IPv6 address. | 2606:2800:21f:cb07::1 |
| CNAME | Makes one name an alias of another name, for example www → example.com. | example.com. |
| MX | Lists the mail servers that receive email for the domain. Lower priority numbers are tried first. | 10 mx1.example.com. |
| NS | Names the servers that hold the domain's DNS zone (your DNS provider). | ns1.example-dns.com. |
| TXT | Free text, used for SPF, DMARC, DKIM and site verification (Google, Microsoft and others). | v=spf1 include:_spf.google.com ~all |
| SOA | Start of authority: the primary name server, admin contact and timers for the zone. | ns1.example.com. admin.example.com. 2026103101 … |
| CAA | Says which certificate authorities may issue SSL certificates for the domain. | 0 issue "letsencrypt.org" |
| SRV | Locates a service such as SIP or XMPP. Query a name like _sip._tcp.example.com. | 10 5 5060 sip.example.com. |
| PTR | Reverse DNS: maps an IP address back to a host name. | server1.example.net. |
| DS | Links the domain to its parent zone for DNSSEC. | 2371 13 2 1F98… |
What the checks mean
- SPF (a TXT record starting with
v=spf1) lists the servers allowed to send email for your domain. A domain must have only one SPF record. Ending it with+alllets anyone send as you. - DMARC (a TXT record at
_dmarc.yourdomain) tells receivers what to do with mail that fails SPF and DKIM. Gmail and Yahoo require DMARC for bulk senders.p=noneonly monitors;quarantineandrejectprotect your domain from spoofing. - DKIM keys sit at
selector._domainkey.yourdomain. The selector depends on your email service, so this checker cannot find it on its own. Enter the full name, for examplegoogle._domainkey.example.com, with type TXT. - DNSSEC signs your records so resolvers can detect tampering. The checker shows it as validated when the resolver confirms the signatures.
- Name servers: use at least two, ideally on different networks, so the domain still resolves if one fails.
Why do I see an old value after changing DNS?
Resolvers keep each answer for its TTL (time to live), shown next to every record. Until that time runs out, some resolvers still return the old value. This is usually called DNS propagation. Lower the TTL a day before a planned change, wait for the old TTL to pass after the change, and use “Compare both” to watch the new value appear. Your own computer and browser may also cache answers for a short time.
Related tools
Hosting Checker · Domain Age Checker · SSL Certificate Checker · Redirect Checker · Redirect Generator · Robots.txt Generator
Frequently asked questions
Is this the same as running nslookup or dig?
It gives the same records as dig example.com A, but the query is answered by Google Public DNS or Cloudflare instead of your own internet provider. That makes the result the same for everyone and avoids old answers stored by your provider.
Why does the checker show no A record for my domain?
Either the record has not been added, the domain uses only a CNAME at www, or the domain does not exist. If the status says “Domain does not exist (NXDOMAIN)”, check the spelling and whether the domain is registered and its name servers are set.
Can I check DNS propagation worldwide?
This tool asks two large public resolvers that are used all over the world. If both return your new value, most visitors will see it soon. Some internet providers keep old answers until the TTL runs out, so a few visitors may see the old value for a while.
How do I find my DKIM record?
Your email provider gives you the selector, for example google for Google Workspace or selector1 for Microsoft 365. Look up selector._domainkey.yourdomain.com with type TXT (Microsoft uses a CNAME).
What is a good TTL?
3600 seconds (1 hour) suits most records. Use 300 seconds (5 minutes) shortly before you move a site or change mail servers, and raise it again afterwards.
Do you store the domains I check?
No. Your browser sends the lookup straight to Google Public DNS or Cloudflare over HTTPS. Our server is not involved, and we keep no list of checked domains. Those DNS services have their own privacy policies.
About this tool. Records come from the public DNS-over-HTTPS services of Google (dns.google) and Cloudflare (cloudflare-dns.com). The checks follow the published rules for SPF (RFC 7208), DMARC (RFC 7489) and CAA (RFC 8659). We tested the checker on domains with CNAME chains, multiple SPF records, null MX, missing DMARC, DNSSEC-signed zones, IPv6 addresses and non-existent domains. Results show what public resolvers return at the moment you check.
Last reviewed: October 2026.