DNS lookup tool
See the live DNS records of any domain: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and more, with TTLs and DNSSEC status. Compare Google and Cloudflare to check whether a change has spread.
- 11 record types, plus SPF and DMARC
- Google and Cloudflare side by side
- No signup needed
IPv4 address
Enter a domain to start
- NameWaiting for inputWhat you entered
- Resolver—Asked over HTTPS
- Nameservers—Where the records live
- Answer—Records returned
DNS records
Enter a domain above to see its records grouped by type, with TTLs, labelled TXT records and checks for website, email and security settings.
Fair-use limit: 30 lookups per hour and 200 per day for each visitor IP address.
How DNS answers reach you
DNS is the internet's address book. Knowing who answers, and for how long they remember, explains most "it still shows the old site" problems.
Your DNS host holds the records
The NS records name the provider, such as Cloudflare, your registrar or your host, where the records are edited. Changes are made there, never in a lookup tool.
Resolvers answer everyone else
Phones and computers ask a resolver such as Google, Cloudflare or their internet provider. The resolver asks your DNS host once and remembers the answer.
TTL decides how long they remember
Each record has a time to live in seconds. Until it runs out, a resolver keeps giving the old answer. That delay is what people call DNS propagation.
Every name is separate
example.com, www.example.com and mail.example.com each have their own records. Look up the exact name you are troubleshooting, not only the main domain.
DNS record types this tool shows
What each type holds, an example value and when you will need it.
| Type | Holds | Example | Used for |
|---|---|---|---|
A |
IPv4 address of the name | 93.184.215.14 |
Where the website or service lives. |
AAAA |
IPv6 address of the name | 2001:db8::1 |
The same, for IPv6 networks. |
CNAME |
An alias to another name | shop.example.com → stores.host.com |
Pointing a subdomain at a hosting or CDN service. |
MX |
Mail servers and their priority | 10 mx1.mailhost.com |
Where email for the domain is delivered. Lower numbers are tried first. |
NS |
Nameservers for the domain | ns1.dnshost.com |
Which DNS provider is in charge of the records. |
TXT |
Free text | v=spf1 include:_spf.google.com ~all |
SPF, DMARC, DKIM and site verification codes. |
SOA |
Zone settings | ns1.dnshost.com, serial 2026101401 |
Primary nameserver, admin contact and refresh timers. |
CAA |
Allowed certificate issuers | 0 issue "letsencrypt.org" |
Which authorities may issue HTTPS certificates. |
SRV |
Service location | 10 5 5060 sip.example.com |
Ports and hosts for services such as SIP, XMPP or Microsoft 365. |
PTR |
Reverse name of an IP | 14.215.184.93.in-addr.arpa → host |
Checking a mail server's sending IP. |
DS |
DNSSEC delegation signer | 2371 13 2 1F987C… |
Links the domain's DNSSEC keys to its parent zone. |
How this tool works
What happens between pressing Look up and seeing the records.
You enter a name
A domain such as example.com, a subdomain such as www.example.com or _dmarc.example.com, or an IP address for a reverse lookup.
The resolvers are asked
Our server sends each record type to Google Public DNS, Cloudflare DNS or both, in parallel, over encrypted DNS-over-HTTPS.
Answers are grouped
Records are grouped by type with their TTL. TXT records are labelled (SPF, DMARC, verification), and the DNSSEC flag is read from the answer.
You get the report
Checks for website, email and security records, every record with copy buttons, and the raw answers, ready to copy or download.
What this tool does, and what it doesn't
A plain list, so you know exactly what to expect.
This tool does
- Show 11 record types with their TTLs
- Label SPF, DMARC and verification TXT records
- Show whether DNSSEC was validated
- Compare Google and Cloudflare answers
- Find reverse (PTR) names for IP addresses
- Copy or download every record
This tool does not
- Change or edit your DNS records
- List every subdomain of a domain
- Query your nameservers directly
- Show DKIM keys without the selector name
- Show domain ownership (use Whois)
- Store the names you look up
Where your data goes
The name you enter is sent from our server to Google Public DNS, Cloudflare DNS or both, over encrypted DNS-over-HTTPS, identifying itself as AllInOneToolsDNSLookup. They see our server, not you. The answers go straight to your browser without being stored. Like any website, our server may keep normal access logs, as described in our privacy policy.
New to DNS? Cloudflare's learning centre explains it step by step.
Why your results might look unexpected
The six surprises people run into most, and what each one means.
A change is not showing yet
Resolvers cache the old answer for its TTL. Compare both resolvers, wait for the old TTL to pass, and lower TTLs before planned moves.
NXDOMAIN, the name does not exist
Check the spelling and the subdomain. If the domain itself is NXDOMAIN, it may have expired or the nameservers at the registrar are wrong.
SERVFAIL
The resolver could not get a trustworthy answer. A broken DNSSEC setup after moving DNS hosts is the most common cause.
No MX record, but email works
Without MX, senders fall back to the A record. It works, but an explicit MX record is more reliable and expected by spam filters.
CNAME instead of an A record
The name is an alias. The tool shows the CNAME and the addresses it finally resolves to. A CNAME cannot sit next to other records on the same name.
Google and Cloudflare disagree
One of them still has the old answer cached, or the domain uses location-based DNS that answers each resolver differently.
Questions about DNS lookups
Where do these DNS records come from?
From Google Public DNS or Cloudflare DNS, two of the largest public resolvers, asked live over encrypted DNS-over-HTTPS when you press Look up. They are the same answers most visitors' devices get, not a copy stored by us.
I changed a record but still see the old one. Why?
Resolvers keep each answer for its TTL (time to live) before asking your DNS host again. If the old record had a TTL of 3600, some resolvers can show it for up to an hour after the change. Use Compare both to see whether Google and Cloudflare already agree, and lower the TTL a day before planned changes.
Why does www show different records from my main domain?
www.example.com and example.com are separate names in DNS, each with its own records. www is often a CNAME pointing to a hosting or CDN address, while the bare domain uses A records, because a CNAME is not allowed at the top of a domain. Look up both names to see the full picture.
What does NXDOMAIN or SERVFAIL mean?
NXDOMAIN means the name does not exist: check the spelling, or the domain may have expired. SERVFAIL means the resolver could not get a valid answer, most often because of a broken DNSSEC signature or nameservers that do not respond. Both show as an error in the result.
What does DNSSEC signed mean?
DNSSEC adds digital signatures to DNS records so resolvers can tell the answer was not forged. When the resolver confirms the signatures, the result shows DNSSEC validated. Many domains are not signed, which is common and not an error, but signing protects against some spoofing attacks.
Can I look up the name of an IP address?
Yes. Enter an IPv4 or IPv6 address and the tool asks for its PTR record, the reverse DNS name set by whoever controls that IP range. Mail servers often check that a sending IP has a matching PTR record.
Are my lookups stored?
No. The name you enter is sent from our server to Google Public DNS and/or Cloudflare DNS, and the answers go straight to your browser without being saved. A hashed, temporary copy of your IP address is used for rate limiting and expires within 24 hours. Like any website, our server may keep normal access logs, as described in our privacy policy.