DNS Lookup
A DNS lookup shows the records a domain uses to tell the internet where to find it. Enter a domain below and pick a record type to see exactly what the name servers answer — the same data your browser, mail server and every other client relies on, often within milliseconds because DNS answers are cached.
Enter a bare domain without http:// or a path — e.g. example.com, not https://example.com/page.
What is DNS?
The Domain Name System (DNS) is the internet's address book. Humans remember names like example.com; machines route traffic to numeric IP addresses. DNS is the translation layer in between. When you type a domain, your device asks a DNS resolver "what is the IP address for this name?", and the resolver returns one or more answers. The same system stores far more than addresses: mail routing, proof that you own a domain, service locations, and policy hints such as which certificate authorities may issue certificates for it.
DNS is a distributed, hierarchical database. No single server knows everything; instead, responsibility is delegated from the top down. That design is what makes DNS able to scale to billions of names, and it is also why a single misconfiguration in one record can take a whole site offline even when the server itself is perfectly fine.
How a DNS lookup works
- Your stub resolver asks a recursive resolver. That is usually your ISP or a public resolver such as
1.1.1.1. If the recursive resolver already has a recent answer in its cache, it replies immediately. - Cache miss → the resolver walks the hierarchy. It asks a root server, which points to the registry for the top-level domain (for
.com,.nl, etc.). - The TLD server points to the authoritative name servers. These are the servers listed in the domain's own NS records.
- The authoritative server answers with the actual record and a TTL (time to live), telling everyone how long they may cache it.
- Answers are cached along the way for the duration of the TTL — from a few seconds to hours or days.
This tool runs on a resolver that performs the same steps, then shows you the record, its value and its TTL. Results are cached for less than a minute on our side so we can serve many lookups quickly without hammering the upstream name servers.
DNS record types
- A — maps a name to an IPv4 address (e.g.
93.184.216.34). The record most websites need. - AAAA — the IPv6 equivalent (quad-A record), used on modern dual-stack networks.
- CNAME — an alias pointing one name at another. Handy for subdomains, but a CNAME cannot coexist with other records on the same name, and it is not allowed at the zone apex in most setups.
- MX — mail exchanger. Lists the servers that accept email for the domain, each with a priority number (lower = preferred).
- TXT — free-form text. Used for SPF, DKIM, DMARC, domain-ownership proofs and other verification strings.
- NS — the authoritative name servers for the zone. If these are wrong, the whole domain can disappear from the internet.
- SOA — Start of Authority. Holds the zone's primary name server, the admin contact, and timing values (serial, refresh, retry, expire, minimum). The serial number must increase whenever the zone changes.
- CAA — Certificate Authority Authorization. Tells certificate authorities which issuers are allowed to issue certificates for the domain.
Common DNS errors and how to fix them
NXDOMAIN is the clearest signal: the name genuinely is not present in the zone. The usual causes are a misspelled host (exmple.com, or a wrong subdomain such as www2 where you meant www), an expired registration, or a record that was deleted but not yet propagated. Fix the spelling; if the base domain resolves but a subdomain does not, add the missing record at your DNS provider.
SERVFAIL notoriously means "something is wrong on the authoritative side". Frequent culprits: a DNSSEC signature that no longer matches the records (often after a key rollover or a move to a new provider), an unreachable or half-configured name server, or a zone that fails to load. If you recently changed providers or edited DNSSEC records, start there — an invalid DS record at the registrar is a classic cause of domain-wide SERVFAIL.
REFUSED comes back when a name server is configured to answer only for its own zones and to refuse everything else, or when access controls block the resolver. It usually points at a configuration issue on the authoritative server rather than a missing record.
A timeout means the query never got an answer. The name servers may be offline or overloaded, a firewall may be dropping UDP/TCP port 53, or the delegation may point at IP addresses that no longer host a DNS server. Verify the NS records still point at hosts that are actually running.
This is often completely normal: a domain may have A and MX records but no TXT. If you expected a record to be there, double-check you created it at the correct name and provider, and give propagation a few minutes.
Reading the results
Each answer row shows the owner name, the type, the TTL (how many seconds the answer may be cached) and the value. A low TTL means changes propagate quickly; a high TTL means the old value may stick around for hours after you edit it. When you see several A records, the domain is load-balanced across multiple servers — clients pick one, often rotating between them. After editing DNS, remember that your own computer may still hold the previous answer in its cache until the TTL expires.
Privacy and limits
Lookups are performed on demand and cached briefly (under a minute) to avoid overloading upstream name servers. Requests are rate-limited per IP address. We do not store a history of the domains you look up.