DNS lookup

See any domain's public DNS records: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA in one go, plus SRV and reverse (PTR) lookups. Each record type comes with its TTL and plain-English notes on what it means.

Only the domain name or IP address is sent, straight from your browser to Cloudflare's public DNS service (or Google Public DNS if Cloudflare doesn't answer). Nothing is stored.

How this tool works

Your browser asks a public DNS resolver for each record type using DNS over HTTPS, the same lookups a browser or mail server makes every day. We show what comes back in a table per type, with the TTL, and add notes where something is worth knowing:

A and AAAA records are the IPv4 and IPv6 addresses a name points to. We flag private addresses, Cloudflare's proxy addresses and a missing IPv6 address.
CNAME makes a name an alias for another name. We show the whole alias chain, and explain why the root of a domain can't be a CNAME.
MX records say which servers receive email. For a full check of SPF, DKIM and DMARC, use the email DNS checker.
TXT records hold text such as SPF and site verification codes. We label the common ones and warn if there's more than one SPF record.
NS and SOA records show which name servers run the domain, who looks after it, and its serial number and timers. We recognise common DNS hosts.
CAA records say which certificate authorities may issue SSL/TLS certificates. If a name has none, we check its parent domains, as certificate authorities do.
SRV records point services such as Microsoft Teams or Autodiscover at a host and port. Enter a service like _sip._tls, or leave it blank to try common ones.
PTR (reverse DNS) turns an IP address back into a name. Enter an IP address, or tick PTR to reverse-look-up a domain's own addresses. We also check the name points back to the same address.

When you look up a domain or its www name, we also compare the two, because a missing www record is a common reason a site "doesn't work" for some visitors.

Tips

Lower the TTL before a move. A day or two before changing hosts, set the TTL on the records you'll change to 300 seconds (5 minutes). After the move, raise it again.
Make sure both versions of your site work. example.co.uk and www.example.co.uk should both resolve, with one redirecting to the other.
Add CAA records. Listing only the certificate authorities you use, for example 0 issue "letsencrypt.org", stops anyone else from getting a certificate for your domain.
Tidy old TXT records. Verification codes for services you've stopped using can usually go, but keep any you're unsure about, because some services check them again later.
Have one SPF record only. Two v=spf1 TXT records make SPF fail for every email.

Frequently asked questions

How long do DNS changes take to show?

Up to the old record's TTL. Resolvers keep a copy for that many seconds, so a record with a TTL of 3600 can take an hour to update everywhere. "Propagation" is really just these copies expiring. The TTL we show counts down while the resolver holds its copy, so it can be lower than the value set at your DNS host.

Why do I see different results from another tool or my own computer?

Different resolvers may be holding copies from different times, and some DNS hosts give different answers depending on where you are, for example to send you to a nearby server. Your office network may also have its own internal DNS. We use Cloudflare's public resolver, or Google's if Cloudflare doesn't answer.

Why can't the root of my domain be a CNAME?

The root of a domain must have SOA and NS records, and the DNS standards don't allow a CNAME to sit alongside other records. Many DNS hosts offer a workaround called ALIAS, ANAME or CNAME flattening, which looks up the target for you and publishes its addresses as normal A and AAAA records.

What does "no CAA records" mean?

That any certificate authority may issue an SSL/TLS certificate for the domain, as long as it can verify control of it. That's the default and isn't a fault, but a CAA record limiting issuance to the authorities you use adds a layer of protection.

Why do my addresses belong to Cloudflare?

If your site is proxied through Cloudflare (the orange cloud), DNS returns Cloudflare's addresses instead of your server's. Visitors connect to Cloudflare, which passes requests on to your real server. That's normal and hides your server's own address.

What is reverse DNS (PTR) used for?

Mostly by mail servers, which check that a sending server's IP address has a name that points back to the same address. Reverse DNS is set by whoever owns the IP address, usually your hosting or broadband provider, not in your domain's own DNS.

Do you store the domains I look up?

No. The lookups go straight from your browser to Cloudflare's public DNS resolver (1.1.1.1), or to Google Public DNS as a fallback. Like any DNS lookup, they see the name and your IP address. Nothing passes through our server and nothing is kept.