What a DNS lookup shows you
A DNS lookup asks the domain name system which records a domain publishes: where its website points, which servers receive its email, who hosts its DNS, and which text records prove ownership or protect its email.
Most DNS checkers stop at a list of raw answers. This one reads them for you. The summary at the top names the email provider from the MX records, the DNS host from the NS records and the web host from the A or CNAME records. A DNS health check then flags the problems that most often break email and websites: a missing or oversized SPF record, no DMARC policy, a single nameserver, and DNSSEC.
Use it as a DNS server lookup when you need to know which nameservers answer for a domain, or as a quick DNS info lookup before you change a DNS entry, so you have a copy of what was there.
- Record types
- A, AAAA, CNAME, MX, NS, TXT, SOA, CAA
- Resolver
- Cloudflare DNS-over-HTTPS, queried live, with Google as a fallback
- Checks
- MX, SPF, DMARC, nameservers, DNSSEC, CAA
- Subdomains
- Supported, e.g. www, mail, _dmarc
- Price
- Free, no account
DNS record types explained
Each DNS record type answers one question about a domain. These are the DNS records the lookup checks and what each one controls.
| Record | What it does | Typical TTL |
|---|---|---|
A | Points a name to an IPv4 address, such as the server hosting the website. | 5 min – 1 hour |
AAAA | Points a name to an IPv6 address. An AAAA record is optional, but common on modern hosting. | 5 min – 1 hour |
CNAME | Makes one name an alias of another, such as www pointing to a hosting platform. | 5 min – 1 hour |
MX | An MX record lists the mail servers that accept email for the domain, in priority order (lower number first). | 1 hour |
NS | Names the nameservers that host the domain’s DNS. | 1 hour – 2 days |
TXT | Free text used for SPF, DMARC, DKIM and domain verification. | 5 min – 1 hour |
SOA | The zone’s start of authority: primary nameserver, admin contact, serial number and timing values. Every DNS zone has exactly one. | 1 hour |
CAA | Lists which certificate authorities may issue SSL certificates for the domain. | 1 hour |
PTR | Reverse DNS: maps an IP address back to a name. Not queried here — check it with Reverse DNS Lookup. | 1 hour |
TTL ranges are common defaults, not rules. Each domain owner sets their own.
A DNS CAA record is worth adding even though it is optional: without one, any certificate authority may issue a certificate for your domain. The DNS SOA record rarely needs editing, but its serial number tells you whether a secondary nameserver has picked up your latest change.
CNAME vs A record: which one to use
An A record points a name straight to an IP address. A CNAME points a name to another name, which then resolves to an address. Use a CNAME when a service gives you a hostname, and an A record when it gives you an IP.
- Root domain: a CNAME can’t share a name with other records, so it can’t sit on
example.comitself, which always has NS and SOA records. Use an A record there, or your DNS provider’s ALIAS or flattened CNAME feature. - ALIAS vs CNAME: an ALIAS record (also called ANAME or CNAME flattening) behaves like a CNAME inside your DNS provider, but answers the outside world with plain A and AAAA records. That is what makes it legal at the root. A lookup shows the resulting A records, not the ALIAS itself.
- Subdomains: CNAMEs are ideal for
www,shopordocspointing at a platform like a store builder or hosting provider. If the platform changes its IP addresses, your record keeps working. - Email: MX records must point to a hostname with its own A or AAAA record, never to a CNAME.
Look up a subdomain such as www.example.com to see whether it uses a CNAME and where the chain ends.
TXT records: SPF, DMARC and domain verification
TXT records hold text that other services read. The most important ones protect your email (SPF and DMARC) or prove you own the domain to services like Google, Microsoft or Facebook.
SPF
An SPF record starts with v=spf1 and lists the servers allowed to send email for the domain. A domain should have exactly one. SPF also has a 10-lookup limit: mechanisms such as include, a, mx, ptr, exists and redirect each count, including those inside included records. Above 10, SPF fails. The lookup follows every include and counts them for you.
DMARC
DMARC lives at _dmarc.example.com and tells receiving servers what to do with email that fails SPF and DKIM: p=none only monitors, p=quarantine sends it to spam and p=reject blocks it. “No DMARC record found” means the domain has none yet — the lookup checks _dmarc automatically and shows the record as its own row.
Domain verification
Services ask you to add a TXT record such as google-site-verification=… or MS=ms… to verify domain ownership via a DNS record. Once added, look the domain up here. The record appears in the TXT tab with the service’s name.
DKIM records sit at selector._domainkey.example.com. Because the selector varies by provider, look up that exact name to check DKIM.
How to find a domain’s DNS provider and nameservers
A domain’s NS records name its nameservers, and the nameservers belong to its DNS provider. The lookup shows the provider by name at the top of the result, so it doubles as a nameserver checker.
What is a DNS provider? It is the company whose servers answer DNS questions for your domain and where you edit its records. Your DNS provider and your registrar are often the same company, but not always. The registrar is where the domain is registered and renewed; the DNS provider is where its records are edited. To find the registrar, use the WHOIS lookup.
A healthy domain has at least two nameservers, ideally on separate networks, so DNS keeps working if one goes down.
Why DNS changes take time: TTL and propagation
DNS changes aren’t pushed out. Each resolver keeps its cached copy of a record until that record’s TTL runs out, then asks again. That is why a change can appear for some people before others.
- The TTL shown in this lookup is the time left in the resolver’s cache, so it counts down between lookups.
- Lower the TTL to 5 minutes a day before a planned change, then raise it again afterwards.
- Nameserver changes at the registrar can take up to 48 hours, because the parent zone’s NS records have long TTLs.
- If a record you just added is missing, wait for the old answer’s TTL to expire before assuming the change failed.
An empty record type is not an error. Most domains publish only a few types, so “no CAA records” simply means none are set.
DNS lookup vs nslookup and dig
nslookup and dig are command-line tools that ask the same questions as this online DNS lookup. The online tool runs every record type at once and explains the answers, while the commands are useful on servers and in scripts.
dig vs nslookup: dig gives fuller, script-friendly output and is standard on macOS and Linux. nslookup is built into Windows and is quicker for one-off checks — an nslookup TXT record query is nslookup -type=txt followed by the name. The raw view in this tool shows results in dig format, ready to copy.
DomainsMesh is an independent tool. DNS answers show what public resolvers returned at the moment of the lookup and can differ between resolvers until cached records expire.
Last updated .