Network Tools

DNS Lookup

Query DNS records like A, AAAA, CNAME, MX and more.

AIPv4 Address
AAAAIPv6 Address
CNAMECanonical Name
MXMail Exchange
NSName Server
TXTText Record
SOAStart of Authority
PTRPointer Record
SRVService Record
CAACA Authorization
🔍

Enter domain to lookup DNS records

Supports A, AAAA, CNAME, MX, NS, TXT and other record types

What is DNS Lookup?

DNS lookup queries Domain Name System records for a domain, retrieving IP addresses and other DNS information.

DNS Record Types

  • A: IPv4 address
  • AAAA: IPv6 address
  • CNAME: Canonical name
  • MX: Mail exchange
  • TXT: Text records
  • NS: Nameservers

Use Cases

  • DNS configuration verification
  • Email troubleshooting
  • Domain migration

Sends one DNS-over-HTTPS query to Cloudflare for a single domain and one of ten record types (A, AAAA, CNAME, MX, NS, TXT, SOA, PTR, SRV, CAA), then lists every answer with its name, value and TTL. Use it to see what a public recursive resolver currently returns for a name you just edited.

Each lookup is one DNS-over-HTTPS GET, not a packet on port 53

Pressing Lookup issues a single GET to https://cloudflare-dns.com/dns-query with the domain in name and the type in type, asking for Accept: application/dns-json. That is Cloudflare JSON envelope around DNS; the RFC 8484 media type for DNS over HTTPS is application/dns-message, so what arrives here is a convenience format rather than the wire body. The component then keeps only Status and Answer, and from each answer the name, type, TTL and data fields. A non-zero Status jumps straight into the warning banner carrying its RCODE meaning: 1 FORMERR, 2 SERVFAIL, 3 NXDOMAIN, 4 NOTIMP, 5 REFUSED. Because the Authority section is never read, a NODATA reply (Status 0, empty Answer, SOA in Authority) renders as a warning banner plus an empty result panel, which looks like a failure but is the correct answer for that type.

Type codes, MX preference, and the quotes that survive in the value

Every row prints the mnemonic of the numeric code the resolver returned: 1 A, 2 NS, 5 CNAME, 6 SOA, 12 PTR, 15 MX, 16 TXT from RFC 1035, 28 AAAA from RFC 3596, 33 SRV from RFC 2782, 257 CAA from RFC 8659. A code outside those ten is rendered as TYPE plus the number, the same convention RFC 3597 defines for unregistered types. The data string passes through with one edit: a single trailing dot is cut. So 10 alt1.gmail-smtp-in.l.google.com. loses the dot but keeps the preference as its first token, and the priority field the component declares is never filled, so sorting is manual; lower preference wins per RFC 1035 3.3.9, while the resolver hands MX rows back unsorted. A SOA value keeps the dots on its nameserver and mailbox because only the final dot of the whole string is removed, and a TXT value keeps the quotation marks the wire format stores.

The client-side name check rejects more than malformed domains

Before any request, a regex validates each label as [a-z0-9]([a-z0-9-]{0,61}[a-z0-9])? and demands a final alphabetic label of two or more characters. That enforces the 63-octet label ceiling from RFC 1035 2.3.4 but never checks the 255-octet total. Underscore is absent from the character class, so _dmarc.google.com and _sip._tcp.example.com are refused here even though the resolver answers them, and those are exactly the TXT and SRV names mail and ACME setups depend on. Bare addresses fail as well, so a PTR query has to be written backwards: 8.8.8.8.in-addr.arpa passes, 8.8.8.8 does not. The trailing dot of example.com., single-label names such as localhost and any non-ASCII IDN are all rejected too, so a Chinese domain has to be converted to punycode first. What is tolerated is a pasted URL: scheme, path and port are stripped before validation.

Worked example

Reverse lookup of 8.8.8.8, spelled as an in-addr.arpa name

Input 
8.8.8.8.in-addr.arpa (type PTR)
Output 
PTR  8.8.8.8.in-addr.arpa  dns.google

The resolver answers with the absolute name dns.google.; the trailing dot is stripped for display, and the value is a hostname because PTR maps an address back to a name. The reversed form is mandatory: 8.8.8.8 alone fails the client-side check before a request leaves the browser. Numeric labels plus the alphabetic arpa label satisfy the regex, which is why this spelling is accepted.

Limits and pitfalls

  • The all-types button fires six parallel queries only (A, AAAA, CNAME, MX, NS, TXT), so SOA, PTR, SRV and CAA never appear in that combined list, and each individual failure is swallowed by a catch block, leaving a shorter list with no sign that something failed.
  • Underscore-prefixed names are blocked client-side: _dmarc.example.com, _acme-challenge.example.com and _sip._tcp.example.com never reach the resolver, so DMARC policy, ACME challenge values and SRV targets cannot be inspected on this page.
  • The card buckets TTLs (under 60 in seconds, under 3600 in minutes, under 86400 in hours, otherwise days) and rounds each band, so 3599 seconds prints as 60 minutes and 86399 seconds as 24 hours; the Copy button emits the untouched seconds if you need the exact figure.
  • Answers keep resolver order with no sorting and no de-duplication, and an A query on a CNAME name lists the CNAME as its own row with its own TTL next to the address record, so the row count is not the number of addresses the name resolves to.
  • One resolver and one transport: Cloudflare over HTTPS, with no nameserver chooser and no DNSSEC validation status, so an authoritative answer cannot be compared against the cached one here, and the TTL shown is remaining cache lifetime rather than the value configured in the zone.

Related tools

When it goes wrong

Some rows come back with no TTL on the right, even though the same record showed a TTL yesterday.

CauseThe TTL cell sits behind v-if="record.ttl", so a TTL of 0 renders nothing at all rather than printing 0s; the Copy routine uses the same truthiness test and silently omits the TTL: segment for that row.

FixRead the blank as TTL 0 — typically a record the zone deliberately keeps uncached — instead of a rendering fault, and copy will not recover the number; check with dig if the exact value matters.

Pasted into a spreadsheet, the columns jump around and the TXT row spills into extra cells.

CauseCopy joins the three fields with a plain tab and never quotes a value. TXT and SOA data carry spaces and the quotation marks of the wire format, so one record emits more cells than the header, while a TTL-0 row emits one fewer.

FixPaste into a plain text editor first, quote the value column, then import; or reproduce the export with A or AAAA records only, whose values are single tokens and align cleanly.

The DKIM key I copy out of a TXT row stops mid-base64 and has stray quotation marks inside it.

CauseA TXT answer longer than one character-string arrives as several quoted strings in data, and the only edit the component applies is removing one trailing dot, so the segments stay quoted and separated. A 2048-bit RSA public key exceeds the 255-byte limit of a single string, so it always splits.

FixJoin the contents of every quoted segment in order with no separator or space — that concatenation is the real key; pasting the string with its quotes intact is what makes DKIM verification fail downstream.

The first lookup pauses noticeably, repeating the same query is instant, and the ms badge reads like resolver performance.

CausequeryTime is wall clock from just before fetch until after response.json(), so a fresh connection includes TCP and TLS setup, a resolver cache miss includes walking to the authoritative servers, and JSON parsing is inside the span too.

FixCompare two runs of the same type to see whether a change propagated rather than treating the number as DNS speed; for a transport-level figure use the query time dig reports, which excludes TLS.

On the office network every attempt only says lookup failed, while the same domain resolves fine over mobile data.

CauseEach query is a direct browser request to cloudflare-dns.com with no server-side proxy and no fallback resolver. A DNS-level block, a TLS-intercepting proxy or an extension aborting the request makes fetch reject, and the catch prints the raw error text; any non-2xx response collapses into one generic string instead.

FixRetry on another network or disable the extension that filters requests; when you only need the records, run dig or nslookup locally. Do not read this banner as a missing record: NXDOMAIN is reported separately as Status 3.

When a recursive answer from one resolver is not enough

SituationThis pageWhere to go instead
You need a name with an underscore, such as _dmarc.example.com or _acme-challenge.example.comThe label regex allows only letters, digits and hyphens, so the request is never sent and the banner reports an invalid domain format.Run dig TXT _dmarc.example.com +short in a terminal, or call the same DoH JSON endpoint from a script where you control the name.
You want to know what the authoritative servers hold, not what a cache is still servingThere is exactly one path, Cloudflare's recursive resolver, and the TTL it prints tells you how long the cache may still serve it, not the number typed into the zone file.dig @ns1.example.com example.com A +norec asks that nameserver directly; the registrar panel shows the stored record as typed.
You need to know whether the answer was DNSSEC-validatedOnly Status and Answer are read, so the AD bit and any RRSIG rows are discarded before rendering.dig +dnssec prints the ad flag and the signatures; dnsviz walks the chain of trust and names the zone where validation breaks.
You want to know who owns the address an A or AAAA record points atThe record value is printed as-is, with no ASN, netblock or country attached.Paste the address into the ip-lookup tool for ASN and geography, or whois the netblock for the registrant and abuse contact.
You want the registrar, creation date or expiry of the domain itselfNothing here touches registration data; DNS only answers which records a name has right now.The whois tool on this site returns registry and registrar fields, including expiry and status codes.
The domain is Chinese or otherwise non-ASCIIThe pre-flight check is ASCII-only, so a Unicode name is refused before any packet is built.Convert it with the punycode tool to its xn-- form and query that ACE label here or with dig.
You need to confirm forty domains all moved to the new addressOne name per click, and even the combined button covers only six types, so a bulk check means forty manual rounds.Loop over the DoH JSON endpoint in a short shell or Node script and diff each Answer array against the expected address.

Frequently Asked Questions

What do A, CNAME, MX, and TXT records each control?
A points a domain at an IPv4 address, AAAA at IPv6; CNAME is an alias to another domain; MX decides which servers receive mail; TXT holds verification data (SPF, DKIM, domain ownership proofs). Server moves are A-record work, email changes are MX work, and most third-party integrations ask for a TXT record.
I changed my DNS — why is it not live yet?
Two cache layers: your OS cache and the resolver cache at your ISP or DNS provider, with the record TTL deciding how long the old value survives (commonly 600 seconds). Compare the authoritative answer (this tool can query it) with the recursive one; flushing the local cache speeds up seeing the new value.
Authoritative versus non-authoritative answers?
Authoritative answers come from the domain’s own nameservers — the current truth; non-authoritative answers come from intermediate caches and may be stale. When "the change did not take effect", check authoritative first: if it shows the new value while recursive lags, just wait out the TTL.

Content reviewed: