DNS Lookup
Query A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records for any domain
Frequently Asked Questions
example.com into machine-readable IP addresses. A DNS lookup queries DNS servers to retrieve these records. Different record types store different information: A records store IPv4 addresses, MX records store mail server info, TXT records store text (often used for domain verification), etc.93.184.216.34). It is the most fundamental DNS record type — when a browser looks up a website, it typically queries the A record first. A domain can have multiple A records for load balancing.aspmx.l.google.com with priority 1).www.example.com might CNAME to example.com. When a DNS resolver sees a CNAME, it continues the lookup to resolve the target. Note: you cannot have a CNAME at a zone apex (root domain).example.com → 93.184.216.34). The most fundamental DNS record type.AAAA record — Maps a domain name to an IPv6 address (e.g.
example.com → 2606:2800:220:1:248:1893:25c8:1946). The IPv6 equivalent of the A record.CNAME record — Creates an alias from one name to another (e.g.
www.example.com → example.com). The resolver follows the CNAME chain to the final A/AAAA record. CNAMEs cannot be used at the zone apex (root domain) and cannot coexist with other record types at the same name.
An authoritative nameserver is the server that holds the actual DNS records for a domain. When a resolver needs to look up
example.com, it ultimately queries the authoritative nameserver for that domain (found via the domain's NS records) to get the definitive answer.
Windows:
ipconfig /flushdns in Command Prompt (run as Administrator)macOS (Sonoma/Ventura):
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderLinux (systemd-resolved):
sudo systemd-resolve --flush-cachesChrome browser: navigate to
chrome://net-internals/#dns and click "Clear host cache"This is useful after DNS changes when your local cache is serving the old IP.
About This DNS Lookup Tool
This free DNS Lookup tool queries the DNS system in real time for any domain. It supports all major record types including A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR. Results include the value, TTL, and any record-specific fields like MX priority or SOA serial number.
DNS Record Types
| Type | Purpose |
|---|---|
| A | Maps domain to IPv4 address |
| AAAA | Maps domain to IPv6 address |
| MX | Mail exchange servers |
| NS | Nameservers for the domain |
| TXT | Text data (SPF, DKIM, etc.) |
| CNAME | Alias to another domain |
| SOA | Start of Authority record |
| PTR | Reverse DNS pointer |
Common TTL Values
| TTL | Duration | Use Case |
|---|---|---|
| 60 | 1 minute | During migrations |
| 300 | 5 minutes | Dynamic/changing |
| 3600 | 1 hour | Standard |
| 86400 | 24 hours | Stable records |
| 604800 | 1 week | Rarely changed |
Standards & References
Related Internet Tools
Related Articles
View all articles
DNSSEC Protects Against Cache Poisoning — Not the Attacks That Actually Cause DNS Outages
DNSSEC signs DNS records cryptographically — protecting against cache poisoning (Kaminsky's 2008 attack) but doing nothing about registrar account compromise, BGP hijacking, or misconfigured records. Here's how DNSSEC's chain of trust works (root → TLD → domain), why expired RRSIG signatures cause SERVFAIL for DNSSEC-validating resolvers including Google and Cloudflare, and why only ~3-5% of .com domains have DNSSEC despite most TLDs being signed.
The Four-Layer DNS Cache — Why the Same Domain Resolves Differently From Different Locations During Propagation
A DNS query might return an answer cached by your browser, your OS, your ISP's resolver, or a CDN's resolver — and each cache has a different expiry time. Here's the four-layer DNS caching chain, why the TTL on your old record controls propagation speed (not the TTL on the new one), how to read the remaining cache TTL from dig output, negative caching (why "doesn't exist" responses are also cached), and why Anycast DNS means propagation isn't geographically simultaneous.
DNS Propagation, TTLs, and Caching: What Actually Happens When You Change a DNS Record
"DNS propagation takes up to 48 hours" is true but vague — the actual mechanism is TTL-governed caching at thousands of independent resolvers, each expiring on its own schedule. Here's how TTL actually controls this, why lowering TTL before a planned change matters, negative caching for new records, and why different users can genuinely see different DNS results during a transition.
DNS over HTTPS: Why Your Browser and Your DNS Lookup Tool Might Be Talking to Different Servers
Your computer's DNS settings and your browser's actual DNS resolution might be using completely different servers — DNS over HTTPS (DoH), increasingly implemented at the browser level, can bypass OS-level DNS settings entirely. Here's why DoH/DoT exist (encrypting DNS queries for privacy), why "dig shows the new record but my browser doesn't" can happen due to separate resolver caches, and how DoH interacts with network-level DNS filtering.
DNS as a Security Tool and Target: Cache Poisoning, Hijacking, and DNSSEC
DNS cache poisoning, DNS hijacking, and DNS tunneling are real attack vectors. Here's how each works, what DNSSEC does (and doesn't) protect against, how to monitor your own DNS records for unexpected changes, and what domain shadowing is.
