DNS Lookup Online — Free DNS Record Checker & Resolver

Popular Network tools

• API Request BuilderBuild and test HTTP API requests with headers, body, auth, and response visualization.
• HAR Analyzer & Request ReplayAnalyze HAR files, inspect slow/failed requests, generate replayable curl/fetch code.
• HAR to Postman Collection ConverterConvert HAR files to Postman Collection v2.1 JSON for API testing.
• Webhook TesterGenerate a unique URL, capture webhook requests, inspect headers & body, and replay them.
• WebSocket TesterConnect to WebSocket endpoints (ws:// or wss://) in real time to inspect frames, measure latency, test heartbeats, and debug payloads.

How to DNS Lookup Online

1. 1

   Enter a fully qualified domain name (e.g., example.com), subdomain (e.g., api.github.com), or public IP address into the search input field.

2. 2

   Select the target DNS record type: choose A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail servers), NS (nameservers), TXT (SPF/DKIM/DMARC), SOA (zone authority), SRV (services), CAA (certificate authority), PTR (reverse DNS), or ALL to query all record types in parallel.

3. 3

   Choose your preferred public DNS resolver: Google Public DNS (8.8.8.8), Cloudflare DNS (1.1.1.1), Quad9 (9.9.9.9), or OpenDNS (208.67.222.222).

4. 4

   Click the "Lookup" button or press ⌘↵ (Ctrl+Enter on Windows/Linux) to initiate real-time server-side DNS resolution.

5. 5

   Review the returned records in the structured output panel, displaying individual record values, TTL (Time-To-Live) cache counters, and record-specific metadata.

6. 6

   For TXT records, observe automatic detection and highlighted labeling of SPF email policies, DKIM keys, DMARC rules, and third-party domain verification tokens.

7. 7

   For MX records, inspect prioritized mail exchanger endpoints sorted in ascending numerical order (lowest number represents highest delivery priority).

8. 8

   For SOA records, analyze the primary authoritative nameserver, responsible administrator email, zone serial revision number, and replication timers.

9. 9

   Switch between different resolvers to cross-check record consistency and diagnose global DNS cache propagation status across networks.

10. 10

    For reverse DNS investigations, select PTR mode and enter any IPv4 or IPv6 address to resolve its canonical pointer hostname.

11. 11

    Copy the complete normalized result as structured JSON with ⌘⇧C or share the exact lookup state using the synchronized browser URL.

12. 12

    Automate DNS audits in your CI/CD pipelines or monitoring scripts by sending requests to our stateless `/api/tools/dns-lookup` REST endpoint.

DNS Lookup Features

• ✓

  10 DNS Record Types: Query A (IPv4), AAAA (IPv6), CNAME (canonical alias), MX (mail exchange), NS (nameserver), TXT (text & verification), SOA (start of authority), SRV (service locator), CAA (certificate authority authorization), and PTR (reverse DNS).

• ✓

  Parallel ALL Query Execution: Simultaneously query all supported record types with a single click to generate an exhaustive DNS profile for any domain.

• ✓

  4 Global Anycast Resolvers: Query Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or OpenDNS (208.67.222.222) to detect DNS caching discrepancies and verify propagation.

• ✓

  Email Security Tag Parsing: Automatically detects and badges SPF (v=spf1), DKIM (v=DKIM1), DMARC (v=DMARC1), and domain verification tokens from Google, Apple, Microsoft, GitHub, and Facebook.

• ✓

  MX Priority Sorting: Clearly formats and orders mail exchange records by priority value to assist in email deliverability and failover troubleshooting.

• ✓

  SOA Zone Breakdown: Deconstructs Start of Authority records into primary nameserver, hostmaster mailbox, serial number, refresh interval, retry timer, expiration window, and minimum/negative TTL.

• ✓

  SRV Service Discovery: Displays structured service discovery attributes including priority, weight, port number, and target hostname for VoIP, SIP, and directory protocols.

• ✓

  CAA Security Audit: Inspects Certification Authority Authorization tags (issue, issuewild, iodef) to ensure compliance with TLS certificate issuance security policies.

• ✓

  Dual-Stack Reverse DNS (PTR): Automatically normalizes IPv4 addresses into in-addr.arpa and IPv6 addresses into ip6.arpa trees to verify reverse DNS and FCrDNS compliance.

• ✓

  Precise Millisecond Query Timing: Measures and displays server-side DNS lookup latency in milliseconds for performance benchmarking across resolvers.

• ✓

  Live Time-To-Live (TTL) Metrics: Displays remaining cache validity in seconds for each individual DNS record to guide migration cutover timing.

• ✓

  Recent Lookup History: Stores your last 10 DNS queries locally in your browser for rapid switching and re-verification during active maintenance windows.

• ✓

  Structured JSON Export: One-click copying of normalized JSON response objects (⌘⇧C) for direct ingestion into monitoring logs, incident reports, and ticketing systems.

• ✓

  Shareable Synchronized URLs: Domain, record type, and resolver parameters sync dynamically to the browser address bar for effortless team collaboration.

• ✓

  High-Throughput REST API: Programmatically access DNS queries via `/api/tools/dns-lookup` with zero CORS restrictions and standard HTTP responses.

• ✓

  Zero Logging & Privacy: DNS queries are processed ephemerally in memory across public resolvers without persisting query strings, user identifiers, or domain logs.

• ✓

  Power User Keyboard Shortcuts: Streamline lookup workflows with ⌘↵ (Run lookup), ⌘⇧A (Query ALL types), ⌘⇧C (Copy JSON), and ⌘⇧K (Clear).

Supported Formats & Dialects

The DNS Lookup supports 10 syntax formats and dialects for accurate parsing and processing.

A (Address IPv4) Record — RFC 1035

Maps a fully qualified domain name (FQDN) to a 32-bit IPv4 address (e.g., 93.184.216.34). The foundational DNS record type used to direct web traffic to origin servers, load balancers, and Anycast network edges.

AAAA (IPv6 Address) Record — RFC 3596

Maps a domain name to a 128-bit IPv6 address (e.g., 2606:2800:220:1:248:1893:25c8:1946). Essential for dual-stack networking, modern mobile client routing, and IPv6-only cloud infrastructure.

CNAME (Canonical Name Alias) Record — RFC 1034 / RFC 2181

Creates an alias from one domain name to another canonical hostname. Under standard DNS specifications, CNAME records cannot coexist with other records at the zone apex (root domain), which is why subdomains (e.g., www, app, cdn) are commonly used for CNAME redirection.

MX (Mail Exchange) Record — RFC 5321 / RFC 7505

Directs incoming SMTP email traffic to authoritative mail servers. Includes an integer priority value (0–65535) where lower numbers specify higher priority. Supports null MX (priority 0, target ".") to explicitly declare that a domain does not accept email.

NS (Authoritative Name Server) Record — RFC 1035

Delegates a DNS zone to authoritative nameservers responsible for publishing and answering queries for that domain. At least two geographically diverse NS records are required for high-availability DNS redundancy.

TXT (Text & Security Authentication) Record — RFC 1035 / RFC 7208 / RFC 7489

Holds arbitrary human-readable or machine-readable text strings up to 255 characters per string segment (concatenated for larger payloads). Widely used for SPF email authorization, DKIM public keys, DMARC policies, and third-party domain verification challenges.

SOA (Start of Authority) Record — RFC 1035 / RFC 2308

Contains core administrative metadata for a DNS zone: primary MNAME nameserver, RNAME administrator mailbox, serial version number, refresh interval, retry interval, expire limit, and minimum/negative caching TTL (RFC 2308).

SRV (Service Locator) Record — RFC 2782

Defines the symbolic service name, transport protocol, priority, weight, listening port, and target hostname for specialized network protocols such as SIP (VoIP), XMPP (chat), Kerberos, LDAP, and Microsoft Active Directory.

CAA (Certification Authority Authorization) Record — RFC 8659

Specifies which Certificate Authorities (CAs) are authorized to issue SSL/TLS certificates for a domain. Uses property tags issue (single-domain/wildcard), issuewild (wildcard only), and iodef (incident reporting endpoint) to block unauthorized certificates.

PTR (Pointer / Reverse DNS) Record — RFC 1035 / RFC 2317

Maps an IP address back to its canonical FQDN within the special in-addr.arpa (IPv4) or ip6.arpa (IPv6) reverse DNS zones. Required for Forward-Confirmed Reverse DNS (FCrDNS) verification by receiving mail transfer agents.

Frequently Asked Questions

What is the difference between authoritative and recursive DNS resolvers?

An authoritative DNS resolver is the official source of truth that hosts and publishes the definitive DNS records for a specific domain name (configured via the domain’s NS records). A recursive DNS resolver (such as Google 8.8.8.8, Cloudflare 1.1.1.1, or an ISP resolver) acts as an intermediary: when a client asks for a record, the recursive resolver queries root servers, TLD servers, and authoritative nameservers on the client’s behalf, caches the answer according to the record’s TTL, and returns the cached result to subsequent queries.

How does DNS TTL caching work and why do DNS changes take time to propagate?

TTL (Time-To-Live) is an integer value set in seconds on every DNS record that instructs intermediate recursive resolvers and client caches how long they may keep a record cached before querying the authoritative nameservers again. If a record has a TTL of 86400 (24 hours), resolvers around the world will serve the cached old record for up to 24 hours after you update your zone. To ensure seamless migrations with minimal downtime, engineers reduce TTLs to 300 seconds (5 minutes) several days before changing IP addresses or mail exchangers.

How do I check SPF, DKIM, and DMARC email authentication records with DNS Lookup?

To check SPF, select the TXT record type and query your apex domain (e.g., example.com); the tool highlights the v=spf1 record defining authorized sending IP addresses and mail services. For DMARC, query the _dmarc.yourdomain.com subdomain using TXT to inspect your alignment policy (p=reject, p=quarantine, or p=none) and reporting addresses (rua=). For DKIM, query your specific selector subdomain (such as google._domainkey.yourdomain.com or s1._domainkey.yourdomain.com) to retrieve the public cryptographic signing key.

Why can a CNAME record not be placed at the zone apex (root domain)?

According to RFC 1034 (Section 3.6.2) and RFC 2181, if a CNAME record is present at a node in the DNS tree, no other record types (such as SOA, NS, MX, or TXT) may exist at that same node. Because a zone apex (e.g., example.com) is required to have SOA and NS records to function, creating a CNAME at the apex violates DNS protocol specifications and breaks nameserver delegation. Modern DNS providers bypass this limitation using proprietary mechanisms like CNAME Flattening, ALIAS records, or ANAME records that dynamically synthesize standard A and AAAA records at query time.

How do MX record priority numbers and fallback mail servers work?

MX (Mail Exchange) records specify the mail transfer agents (MTAs) responsible for receiving email for a domain. Each MX record includes an integer preference/priority value between 0 and 65535. Sending mail servers attempt delivery to the MX record with the lowest numerical preference first (e.g., preference 10 before preference 20). If the primary mail server is unreachable or timing out, the sender automatically falls back to secondary servers with higher numerical preference values. When multiple MX records share the same priority number, sending servers distribute traffic across them randomly for load sharing.

What is a CAA record and how does it prevent unauthorized SSL/TLS certificates?

A Certification Authority Authorization (CAA) DNS record (RFC 8659) allows domain owners to declare which Certificate Authorities (such as Let’s Encrypt, DigiCert, or Sectigo) are permitted to issue SSL/TLS certificates for their hostnames. Before issuing any certificate, public CAs are mandated by the CA/Browser Forum to query the domain’s CAA records. A CAA record can restrict general certificate issuance with issue "letsencrypt.org", wildcard certificates with issuewild ";", or specify an incident violation email using iodef "mailto:[email protected]".

What do the SOA record timers (Serial, Refresh, Retry, Expire, Minimum TTL) mean?

Start of Authority (SOA) records govern zone replication between primary and secondary nameservers: Serial is the zone version number (often in YYYYMMDDNN format); Refresh is the interval in seconds secondary nameservers wait before querying the primary for updates; Retry is the duration to wait before retrying a failed zone transfer; Expire is the maximum duration a secondary server will continue answering queries if the primary remains unreachable; and Minimum TTL (RFC 2308) defines the negative caching duration—the time recursive resolvers cache NXDOMAIN (non-existent domain) responses.

What is Reverse DNS (PTR) and how does Forward-Confirmed Reverse DNS (FCrDNS) prevent spam flags?

Reverse DNS maps an IP address back to its canonical hostname using PTR records stored in the in-addr.arpa (IPv4) or ip6.arpa (IPv6) domains. Forward-Confirmed Reverse DNS (FCrDNS) is a verification procedure where a receiving server performs a reverse lookup on the connecting IP to get the PTR hostname, and then immediately performs a forward lookup on that hostname to verify it points back to the exact same IP address. Major email providers like Gmail, Microsoft 365, and Yahoo require valid FCrDNS on sending mail servers, immediately rejecting or spam-binning connections that lack matching reverse DNS.

How does querying multiple public resolvers (Google, Cloudflare, Quad9, OpenDNS) help verify propagation?

Different public recursive DNS resolvers maintain independent global Anycast server networks and distributed caching layers. When you update DNS records at your authoritative nameserver, cached entries at different resolvers expire at different times depending on when they last fetched the record. By comparing responses from Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9), and OpenDNS (208.67.222.222), you can immediately determine whether your DNS changes have propagated across major internet backbones or are still being served from stale intermediate caches.

Does this DNS lookup tool support subdomains, wildcards, and delegated zone lookups?

Yes. You can enter any fully qualified domain name (FQDN), deep subdomain (e.g., staging.api.v2.example.com), service prefix (e.g., _sip._tls.example.com), or verification prefix (e.g., _dmarc.example.com). The server-side resolver queries the appropriate authoritative nameservers through the selected public resolver and handles CNAME redirection chains and delegated child zones automatically.

How can I query the DNS lookup tool programmatically via REST API or CLI scripts?

You can perform programmatic DNS lookups by making HTTP GET or POST requests to our REST endpoint: GET https://wtool.dev/api/tools/dns-lookup?domain=example.com&type=A&resolver=cloudflare. The API returns a standardized JSON payload containing the queried domain, queryType, resolver metadata, latency in milliseconds, timestamp, and an array of parsed DNS records with their respective TTL and data values, making it ideal for integration into monitoring daemons and deployment scripts.

Does DevFlow DNS Lookup log, record, or track the domains I query?

No. We maintain a strict zero-retention privacy policy. When you submit a domain or IP for lookup, the request is executed ephemerally in memory by querying the selected public DNS resolver. We do not write queried domains, user IP addresses, or lookup timestamps to databases, server logs, or persistent storage. Your recent lookup history is stored exclusively in your local browser localStorage and can be cleared at any time.

Related Developer Tools

• IP LookupLook up geolocation, network, and security details for any IP address.
• IP to HostnameReverse DNS lookup — resolve PTR records to find hostnames for any IPv4 or IPv6 address.
• DMARC, SPF & DKIM CheckerCheck DMARC, SPF & DKIM records for any domain, get an authentication score, and generate SPF/DMARC records.
• Domain WHOISLook up domain registration info — registrar, dates, name servers, and status.
• HTTP Headers AnalyzerAnalyze HTTP response headers for security, caching, and compliance issues.
• SSL/TLS Certificate DecoderDecode PEM & X.509 certificates offline or inspect live SSL/TLS certificate chains with expiration countdowns and health checks.
• CIDR & Subnet CalculatorCalculate IPv4/IPv6 subnets, network/broadcast addresses, usable IP ranges, wildcard masks, and visual bitwise subnet splitting.
• Redirect CheckerTrace URL redirect chains and detect 301, 302, 307, and 308 redirects.