NetworkAI
  • MonitoringCertificate & Domain MonitorDaily checks of TLS certificates, domain registration and DNS, with alerts when a renewal fails.
  • AssessmentSecurity AssessmentA passive security report for a domain you own: TLS, DNS, email authentication, headers and registration.
Free tools
Start hereDomain Health CheckSSL, DNS, email authentication, security headers and expiry in one scored report.Run a health check →
Domain
  • Bulk Domain Expiry Checker
  • RDAP Domain Lookup
  • WHOIS Lookup
SSL / TLS
  • SSL Certificate Checker
  • Bulk SSL Expiry Checker
  • 47-Day Certificate Lifetime Calculator
  • Certificate Lifetime Readiness
  • Post-Quantum TLS Checker
DNS
  • DNS Lookup
  • MX Lookup
  • CAA Record Checker
  • DNS Propagation Checker
  • TXT Record Lookup
  • NS Lookup
  • CNAME Lookup
  • Reverse DNS Lookup
Email authentication
  • SPF Record Checker
  • SPF Record Generator
  • DMARC Record Checker
  • DMARC Record Generator
  • DKIM Record Checker
  • Email Sender Requirements Checker
Website security
  • Security Headers Checker
Network & IP
  • What Is My IP Address
  • Subnet Calculator
All free tools →
PricingDocsGuides
Log inStart free
  • MonitoringCertificate & Domain MonitorDaily checks of TLS certificates, domain registration and DNS, with alerts when a renewal fails.
  • AssessmentSecurity AssessmentA passive security report for a domain you own: TLS, DNS, email authentication, headers and registration.
Free tools
Start hereDomain Health Check
Domain
  • Bulk Domain Expiry Checker
  • RDAP Domain Lookup
  • WHOIS Lookup
SSL / TLS
  • SSL Certificate Checker
  • Bulk SSL Expiry Checker
  • 47-Day Certificate Lifetime Calculator
  • Certificate Lifetime Readiness
  • Post-Quantum TLS Checker
DNS
  • DNS Lookup
  • MX Lookup
  • CAA Record Checker
  • DNS Propagation Checker
  • TXT Record Lookup
  • NS Lookup
  • CNAME Lookup
  • Reverse DNS Lookup
Email authentication
  • SPF Record Checker
  • SPF Record Generator
  • DMARC Record Checker
  • DMARC Record Generator
  • DKIM Record Checker
  • Email Sender Requirements Checker
Website security
  • Security Headers Checker
Network & IP
  • What Is My IP Address
  • Subnet Calculator
All free tools →
PricingDocsGuides
Start freeLog in
  1. Home
  2. /Free tools
  3. /DNS
  4. /DNS Lookup
Free tool · No signup

DNS Lookup

Enter a domain to see all of its DNS records at once — A, AAAA, CNAME, MX, NS, TXT, CAA and SOA — for developers and admins checking a change or debugging a domain.

Results come from public resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) and are cached for up to a minute. A mail server may see something different if a record changed recently — changes take up to the record's TTL to propagate.

Get this as an API

Early access · not available yet

We are building an API that returns these checks as JSON. It does not exist yet — the request and response below show the planned shape and may change. Join the waitlist and we will email you once, when early access opens.

Planned request
curl "https://networkaitools.com/api/v1/dns?domain=example.com" \
  -H "Authorization: Bearer nk_live_..."
Planned response
{
  "status": "ok",
  "records": {
    "A": ["93.184.215.14"],
    "MX": [{ "priority": 10, "exchange": "mail.example.com" }],
    "CAA": [{ "flags": 0, "tag": "issue", "value": "letsencrypt.org" }]
  },
  "resolver": "1.1.1.1"
}

Used only to tell you when the API opens. No newsletter, and you confirm by email first.

What is a DNS lookup?

A DNS lookup asks the Domain Name System what is published for a name. DNS stores different kinds of records for each domain: addresses for its website, the servers that accept its email, text records used for verification and email security, and the nameservers that hold all of it.

What each record type means

TypeWhat it holdsTypical use
AAn IPv4 addressPoints the name at a web server
AAAAAn IPv6 addressThe same, for IPv6 networks
CNAMEAn alias to another namewww pointing at a hosting provider
MXMail servers and their priorityWhere email for the domain is delivered
NSThe authoritative nameserversWhich DNS provider answers for the domain
TXTFree-form textSPF, domain verification, DKIM keys
CAACertificate authorities allowed to issueLimits who can issue TLS certificates
SOAZone metadata and serial numberShows the primary nameserver and when the zone last changed

How to read the results

Each record type is queried separately and shown as its own group. A group marked as empty means the name exists but has no record of that type, which is normal — most domains have no CNAME at the root, and many have no AAAA.

  • No records at all usually means the name does not exist: a typo, or a domain that has not been registered or delegated.
  • No A or AAAA means the name has no address, so nothing can connect to it as a website.
  • One nameserver is a single point of failure. The DNS standard (RFC 1034) expects at least two.
  • A CNAME alongside MX or NS is invalid: a CNAME cannot share a name with other records.
  • No AAAA is only a note. The site works, but not over IPv6-only connections.

Queries go to the public resolver 1.1.1.1, so you see what the wider internet sees, including cached answers. That is the right view for checking whether a change has taken effect for real visitors.

Why a DNS change is not visible yet

DNS does not push changes out. Every record carries a TTL — a number of seconds resolvers may keep a cached copy. After you edit a record, resolvers that already hold the old answer keep serving it until their copy expires. People call this propagation, but it is really just caches timing out.

To make a planned change take effect quickly:

  • Lower the record's TTL to 300 seconds a day or two before the change.
  • Make the change, then confirm it here.
  • Raise the TTL back to an hour or more once everything works.
Nameserver changes at the registrar are slower. The parent zone's NS records commonly have a TTL of 48 hours, and you cannot shorten it.

Common fixes

Website does not load on the bare domain. The root needs its own A/AAAA record. A www record does not cover it:

example.com.      A      203.0.113.10
www.example.com.  CNAME  example.com.

CNAME at the root is rejected. The DNS standard does not allow a CNAME at the zone apex, because the apex must also hold NS and SOA records. Use your DNS host's ALIAS, ANAME or CNAME-flattening feature instead.

Email stopped after moving DNS providers. MX and TXT records are easy to leave behind in a migration. Compare this output with the old zone, then check them directly with the MX lookup and SPF checker.

Frequently asked questions

How do I check the DNS records of a domain?

+

Enter the domain in the box above. The tool queries a public resolver for A, AAAA, CNAME, MX, NS, TXT, CAA and SOA records and lists each group. From a terminal, dig example.com ANY is unreliable — most servers refuse ANY queries — so query each type separately.

How long does DNS propagation take?

+

As long as the old record's TTL. A record with a 300-second TTL is replaced everywhere within about five minutes; one with an 86400-second TTL can linger for a day. Changing nameservers at the registrar can take up to 48 hours.

What is the difference between an A record and a CNAME?

+

An A record maps a name directly to an IPv4 address. A CNAME maps a name to another name, and the resolver then looks that one up. Use a CNAME when a provider may change its IP addresses; use an A record when you control a fixed address.

Can a domain have multiple TXT records?

+

Yes. A domain commonly has several — SPF, site verification for Google or Microsoft, and others. The exception is that only one of them may start with v=spf1. DKIM and DMARC records live on their own subdomains, not at the root.

Why are the results different from my own computer?

+

Your computer asks your ISP's or company's resolver, which may hold an older cached answer, or may be configured to answer differently for internal names. This tool asks a public resolver, which shows what most of the internet currently sees.

What does the SOA serial number tell me?

+

It is a version counter for the zone. DNS providers increase it whenever the zone changes, and secondary nameservers use it to know when to fetch a fresh copy. If the serial has not changed after an edit, the edit was probably not saved.

Related tools

All DNS tools →
  • DNS Propagation Checker

    See whether 20 public DNS resolvers return your new A, MX, TXT or CNAME record yet.

  • TXT Record Lookup

    Every TXT record on a domain, with SPF, DMARC and verification tokens labelled.

  • NS Lookup

    A domain's name servers, their IP addresses, and whether each one answers with the same zone.

  • CNAME Lookup

    Follow a CNAME chain hop by hop to the final hostname and its IP addresses.

  • MX Lookup

    Mail servers in priority order, what they resolve to, and the provider behind them.

  • Reverse DNS Lookup

    The PTR hostname for an IPv4 or IPv6 address, and whether it resolves back to the same IP.

Written and maintained by the NetworkAI team, built by a working network security engineer · Last updated October 12, 2026

NetworkAI

Renewal-failure alerts for TLS certificates and domain registrations.

Product

  • Certificate monitor
  • Pricing
  • Log in
  • Start free

Free tools

  • Domain Health Check
  • SSL Certificate Checker
  • SPF Record Checker
  • DMARC Record Checker
  • Security Headers Checker
  • DNS Lookup
  • All free tools →

Tool categories

  • Domain
  • SSL / TLS
  • DNS
  • Email authentication
  • Website security
  • Network & IP

Resources

  • Documentation
  • Slack & webhook alerts
  • Guides
  • All comparisons
  • NetworkAI vs UptimeRobot
© 2026 NetworkAI · Built by a network security engineer
PrivacyTerms
EspañolالعربيةDeutsch