DNS Lookup
Check the DNS records of a domain from your browser. See where it points, which servers receive its email, its TXT records for SPF and verification, and whether the answer was validated with DNSSEC.
INPUT
RESULT
Enter a domain and choose Look up. The query goes from your browser to the resolver you chose.
The name and record type are sent from your browser to the resolver you choose (Cloudflare or Google). Nothing goes to a Deskbox server.
How to look up DNS records
Enter a domain
Type a domain or paste a URL. Subdomains and service names such as _dmarc.example.com work too, and an IP address looks up its PTR record.
Pick a record type
Choose All for the common types at once, or a single type such as MX or TXT. Choose Cloudflare or Google as the resolver.
Read the answers
Each record shows its name, time to live and data. A badge shows whether the resolver validated the answer with DNSSEC.
Which record does what
A and AAAA give a name's IPv4 and IPv6 addresses, and CNAME makes a name an alias of another. MX lists the servers that accept email for the domain, TXT holds text such as SPF and DKIM settings and site verification codes, NS names the domain's name servers and SOA describes the zone. CAA limits which certificate authorities may issue certificates, SRV points to services and PTR maps an address back to a name.
Why results can differ from what you see
Records are cached for their time to live (TTL), so a change can take that long to show everywhere. Your company network or internet provider may also answer differently from public resolvers, for example for internal names. This tool asks Cloudflare or Google directly, so it shows what the public internet sees.
Frequently asked questions
Where is my query sent?
Straight from your browser to the resolver you choose, Cloudflare (cloudflare-dns.com) or Google (dns.google), over DNS-over-HTTPS. The resolver receives the name and the record type; nothing goes through a Deskbox server.
What do NXDOMAIN and SERVFAIL mean?
NXDOMAIN means the domain doesn't exist. SERVFAIL means the resolver couldn't get a reliable answer, often because the domain's DNSSEC is broken or its name servers don't respond. "No records" for a type simply means the name exists but has none of that kind.
What does the DNSSEC badge show?
It shows the resolver's Authenticated Data flag: the answer was checked against the domain's DNSSEC signatures. "Not validated" usually means the domain isn't signed, not that the answer is wrong.