DNS Lookup

Enter a domain to query its A, AAAA, CNAME, MX, NS, TXT and SOA records in one go, and see whether SPF and DMARC are set up to protect its email. Free, instant, no signup.

What this looks up & how to read it

All seven record types are queried in parallel, straight from DNS, with a short timeout on each so a slow authoritative server cannot stall the page. A and AAAA are the IPv4 and IPv6 addresses the name resolves to; CNAME shows if the name is an alias; MX lists mail servers by priority; NS the servers authoritative for the zone; TXT the free-text records used for domain verification and email policy; and SOA the zone's primary server, contact and timers. A type with no records is shown as exactly that — it is only reported as an error when the lookup itself failed.

The email checks

Two TXT records decide whether mail from your domain is trusted. SPF is a v=spf1 record on the domain listing which servers may send as it. DMARC is a v=DMARC1 record at _dmarc.yourdomain telling receivers what to do when SPF or DKIM fails: p=none only reports, p=quarantine sends failures to spam, p=reject refuses them. Both are added as TXT records at your DNS host; the results explain what is missing and what a sensible value looks like.

Frequently asked questions

Why does www.mysite.com show a CNAME but no NS or SOA records?

Because it is an alias. A CNAME says 'this name is really that other name', and DNS does not allow any other record type alongside it — the NS and SOA belong to the zone it points into. That is normal for a www host on a CDN or hosting platform. Look up the bare domain to see the zone's own NS and SOA.

What do SPF and DMARC have to do with my website?

Nothing for ranking, everything for your domain's reputation. Without SPF, anyone can send email that claims to come from your domain; without DMARC, receivers do nothing about it and you never find out. Gmail and Yahoo now require both from anyone sending bulk mail. Even a site that never sends mail should publish 'v=spf1 -all' and a DMARC record with p=reject so it cannot be used for phishing.

Why are SPF and DMARC checked on a different name than I entered?

Mail policy lives on the domain that appears after the @ in an address, so when you look up www.example.com the tool checks SPF on example.com and DMARC at _dmarc.example.com, and says so in the results. For a subdomain like shop.example.com it checks that subdomain, since subdomains can carry their own policy.

I just changed a record and the tool still shows the old value. Why?

DNS caching. Every record carries a TTL, and resolvers keep serving the old answer until it runs out — commonly an hour, sometimes a day for NS changes. The tool asks the server's resolver and, if that fails, public resolvers, each of which may have cached the old value. Lower the TTL before making a change you want to propagate quickly.

What do the SOA timers mean?

They tell secondary name servers how to stay in sync with the primary: refresh is how often to check for changes, retry how soon to try again after a failed check, expire how long to keep answering if the primary stays unreachable, and minimum TTL is how long a 'no such record' answer may be cached. The serial number increments on every zone change, which is a handy way to confirm an edit was actually published.

Related tools

HTTP Header CheckerSSL Certificate CheckerDomain Age CheckerIP & Hosting Lookup

Command Palette

Search for a command to run...