DNS Lookup

Most DNS tools make you check one record type, change a dropdown, check again, and repeat that eight times before you actually understand how a domain is set up. This one does it in a single click. Leave the record type on All records, type a domain, and you get its A, AAAA, MX, TXT, NS, CNAME, SOA, and CAA records back together, grouped by type, in one clean view. That is the whole DNS picture at once instead of eight separate lookups.

And the query never touches our servers. The lookup goes straight from your browser to Cloudflare's public 1.1.1.1 resolver over encrypted HTTPS, so the only thing sent anywhere is the domain name you typed. A lot of the popular DNS checkers run the query on their own backend and quietly log every domain you look up. We don't want your queries and we never see them. When the answers land, one button copies them all as text and another exports the set to a CSV you can drop into a ticket or a spreadsheet.

1. Type a domain into the box, for example example.com. Paste a full URL if that is what you have and it gets cut back to the bare domain first, so a port like :8443, a path, or a tracking query on the end never follows it into the lookup. If what you pasted is not a domain at all, the tool says so rather than looking up something you did not ask for.
2. Leave the record type on All records to pull everything at once, or pick a single type (A, AAAA, MX, TXT, NS, CNAME, SOA, or CAA) if you only care about one.
3. Click Look up. Results come back grouped by record type, each with its name, TTL, and value.
4. Hit Copy to put the whole result on your clipboard as text, or Download CSV for a spreadsheet-ready file.
5. Use Share to copy a link that reopens this exact domain and mode, handy for sending a colleague the same view.

When something is broken, the problem is rarely the one record type you decided to check first. Email starts bouncing and you look at MX, but the real culprit is a TXT record where the SPF entry is missing a mail host. A site loads for you and not for a coworker, and an old CNAME is still pointing a subdomain at a host that got decommissioned. Checking one type at a time, you stare right past the record causing the trouble.

Seeing all eight together changes how fast you spot that. You get the shape of the whole zone in one read, which records exist, which are empty, where a value looks off. For a domain migration that full view is what lets you cut over with confidence. You want to know exactly what is published today so you can recreate it on the new provider, then confirm every record followed after the move. That takes just one lookup on each side.

The empty types matter too, so the tool lists which came back with nothing rather than hiding them. A domain with no CAA record, for instance, lets any certificate authority issue a certificate for it.

Each type answers a different question about a domain. Read together they explain how the whole thing is wired.

A and AAAA map the domain to an address. The A record is the familiar IPv4 address like 93.184.216.34, and AAAA is the same idea for the longer IPv6 format. This is what a browser actually connects to. If a domain clearly exists but a site won't load, a missing or wrong A record is the first suspect.

MX lists the mail servers that accept email for the domain, each with a priority number, and the lower numbers get tried first. It is also the quickest way to see who runs a domain's email, since Google Workspace, Microsoft 365, or a self-hosted box all show up plainly in the values.

TXT holds free-form text, and it quietly runs a huge amount of the modern internet. In practice it carries SPF and DKIM records that fight email spoofing and keep your mail out of spam folders, DMARC policies that tell receivers how to treat suspicious mail, and the verification strings a service hands you when it asks you to prove you own the domain. When a provider says it "cannot verify" your domain, the mismatch is almost always sitting right here in the TXT records.

NS names the authoritative name servers that hold the real answers for the domain. If you are switching hosts or registrars, the NS records tell you who is in charge of the DNS right now.

CNAME points one name at another name, an alias. It is how a subdomain like www gets aimed at another hostname without hard-coding an address that might change later.

SOA (start of authority) carries the administrative details for the zone: the primary name server, the responsible contact, and the timers that control how often secondary servers refresh.

CAA says which certificate authorities are allowed to issue TLS certificates for the domain. It is a real security guardrail. Lock it to one authority and a different one is supposed to refuse the request, which cuts the risk of a fraudulent certificate.

Every record comes back with a TTL, which stands for time to live. It is the number of seconds a resolver is allowed to keep the record cached before it checks again, and it is the reason people talk about DNS changes needing time to propagate.

Right after you edit a record, resolvers that already cached the old value keep serving it until that TTL runs out. A record with a TTL of 3600 can show the old value for up to an hour, one at 300 clears in five minutes. Lower the TTL a day before a planned change, so when you flip the real value it takes effect almost immediately. Because every resolver caches on its own schedule, you might see the new value here while someone on another network still sees the old one, that is normal and it sorts itself out as the caches expire.

DNS logs are a real privacy problem. Any lookup site that runs the query on its own backend is in a position to keep every domain you check, and from the outside you have no way to tell whether it does. This tool sends only the single domain you enter, straight to Cloudflare's public 1.1.1.1 resolver over encrypted HTTPS, not to us. Cloudflare's DNS-over-HTTPS service is built for exactly this kind of direct browser use and its privacy terms are published, so you are not taking our word for it.