TechCompare LogoTechCompare
Showing centimeters. Press to switch to inches.Showing inches. Press to switch to centimeters.
Back

DNS Lookup

Look up a domain's records on Cloudflare, or ask several resolvers at once to see where they differ. SPF, DMARC and DKIM are checked too, and an IP address gets a reverse lookup.

Resolvers

Pick more than one to compare their answers.

Your browser sends the domain straight to the resolvers you pick. It doesn't pass through TechCompare. See the privacy policy.

Look up a domain

Type a domain or an IP address above, or try one of these. Nothing is sent until you press Look up.

How to use this tool

  1. Enter a domain or an IP address

    Type a domain like example.com. You can paste a full URL or an email address, and the tool keeps only the domain. Names with accents or other scripts are turned into punycode, the form DNS uses. Type an IP address instead to get its reverse DNS name.

  2. Pick a record type

    All types asks for A, AAAA, CNAME, MX, TXT, NS and CAA at once. Pick a single type when you only care about one, like MX for mail or TXT for a verification code.

  3. Press Look up and add resolvers to compare

    Each value shows its TTL. Pick Google, DNS4EU, Control D or your own server too, and every value lists each resolver's TTL. A value only one of them returned is marked, and each type shows Same answer or Answers differ.

  4. Check the email records

    With All types, TXT or MX, the tool reads the SPF record and counts its lookups through every include, explains the DMARC record, and checks a DKIM key once you enter its selector.

  5. Open More records

    More records asks for the SOA, HTTPS, DS and DNSKEY records and checks that DNSSEC is linked up. It also checks DANE on each mail server, and looks up an SRV record once you type a service like _imaps._tcp.

About this tool

This DNS lookup asks Cloudflare's public resolver for a domain's records and shows each value with its TTL. Pick Google, DNS4EU, Control D or your own DNS over HTTPS server as well, and it asks them all at once and lines up their answers. When they agree, you can trust that the record has spread. When they don't, the tool marks the values only some of them returned, so you can see a change that's still on its way or a setup that answers differently by location.

Your browser asks the resolvers directly over DNS over HTTPS. Nothing goes through TechCompare, and nothing is sent until you press Look up.

Reading the TTL

Each row shows the time left in that resolver's cache, in plain time and in seconds. A record with a TTL of 3600 seconds (1 hour) shows 3600 right after a resolver fetches it and counts down from there. When it reaches zero the resolver asks the domain's name servers again. That countdown is why a change can take up to the old TTL to show up everywhere.

Three ways a lookup can come back empty

NXDOMAIN means the name doesn't exist. No records means it exists but has nothing of that type. SERVFAIL means the resolver tried and couldn't get a trustworthy answer, which usually comes from a broken DNSSEC setup or name servers that don't respond. The tool words each one differently, since the fix is different too.

DNSSEC and the AD flag

A resolver that checks DNSSEC signatures sets the AD (authenticated data) flag when they hold up, and the tool shows a DNSSEC badge for it. No flag usually means the domain isn't signed, or that the resolver doesn't check. It doesn't mean the answer is wrong. To see whether a domain is signed at all, open More records and read the DS card.

Reverse lookups for IP addresses

Type an IPv4 or IPv6 address and the tool asks for its PTR record, at a name like 10.2.0.192.in-addr.arpa. Then it looks up each name it finds and checks that the name points back to the same address. Mail servers run the same check, and Gmail blocks mail from a sending server that fails it. Private addresses like 192.168.1.1 have no name in public DNS, so the tool says so instead of calling it a missing record.

More records: SOA, HTTPS, DNSSEC keys, SRV and DANE

None of these are asked for until you open the section. SOA shows the zone's serial number and its timers in plain time. HTTPS shows which HTTP versions a site offers and whether it has an ECH key, which hides the site name from the network. Sites replace that key from time to time, so a different ECH key alone doesn't count as a mismatch between resolvers. DS and DNSKEY get a check that the parent zone's DS record points at a key the domain publishes. DANE reads the TLSA records at _25._tcp on each mail server and only calls them usable when DNSSEC checks out, since sending servers ignore them otherwise.

Which resolvers to compare

Cloudflare, Google, DNS4EU and Control D's free resolver pass on what the domain publishes. DNS4EU is the EU's public resolver, run by the Czech company Whalebone in EU data centers, and the tool uses its unfiltered version. A custom server works if it speaks DNS over HTTPS and lets web pages read its answers. If it filters, a name that resolves everywhere except there may be on its blocklist.

Email records in plain words

SPF, DMARC and DKIM are TXT records written in a terse tag syntax. The tool lists them and flags the mistakes that make mail fail: more than one SPF record, more than 10 SPF lookups, a DMARC policy of none, and a revoked or short DKIM key. Open a record's dropdown to see every term explained, with the defaults it leaves out.

DNS and email record guides

What each record does, how to read it, and how to fix the usual mistakes.

What is a TXT record?
Verification codes, SPF and DKIM keys in one record type
View details
SPF vs DKIM vs DMARC
What each one checks and why you need all three
View details
What an MX record does
How mail finds your servers, and what the priority number means
View details

Frequently asked questions

Why do resolvers show different TTLs for the same record?
A resolver's TTL is a countdown. When it fetches a record it starts the clock from the TTL the domain set, and it hands out the time that's left until the copy expires. Two resolvers fetch the record at different moments, so their clocks rarely line up. That's why the tool never counts a TTL gap as a mismatch. Only the data has to match.
Why would two resolvers give different answers?
The usual reason is a recent change. One resolver still holds the old record until its cached copy expires, while the other has already fetched the new one. Big sites also answer by location, so a CDN can hand each resolver the servers closest to it. A SERVFAIL on one side and a normal answer on the other often points to a DNSSEC problem that only one resolver noticed, or to a name server that's out of sync with the rest. A filtering resolver often answers NXDOMAIN for names on its blocklists, so if you add one as your own server, a name missing only there may be blocked.
What's the difference between NXDOMAIN and no records?
NXDOMAIN means the name doesn't exist at all, so there's nothing of any type there. No records (NOERROR with an empty answer) means the name exists but holds no records of the type you asked for, like a domain with an A record and no AAAA. A typo in the domain usually gives NXDOMAIN, while a missing IPv6 or mail setup gives no records.
Does this tool send my domain anywhere?
Your browser sends the domain straight to the resolvers you pick over HTTPS, the same way any DNS over HTTPS client would. That's Cloudflare (cloudflare-dns.com) by default, plus Google (dns.google), DNS4EU (unfiltered.joindns4.eu), Control D (freedns.controld.com) or your own server when you add them. It doesn't pass through TechCompare's servers. The email checks ask the first resolver on the list for the _dmarc name, the SPF includes and the DKIM selector you enter.
Can I use my own DNS server?
Yes, if it speaks DNS over HTTPS (RFC 8484) and lets web pages read its answers, which is called CORS. Pick Custom and enter its address, which often ends in /dns-query. Some public DNS over HTTPS services don't allow requests from web pages, so a browser can't read their answers. The address stays in the link, so you can share the lookup.
Why does the SPF check count DNS lookups?
RFC 7208 lets a receiver make at most 10 DNS lookups while it checks one SPF record. The include, a, mx, ptr and exists terms and the redirect modifier each cost one, and the terms inside every included record count too. Go over 10 and the check ends in a permanent error, so SPF fails even for your real mail servers. ip4, ip6 and all cost nothing.
How do I do a reverse DNS lookup?
Type the IP address into the field instead of a domain. The tool turns it into its reverse name, like 8.8.8.8.in-addr.arpa, and asks for the PTR record there. It then looks up each name it finds and checks that it points back to the same address, which is what mail servers check too. Only whoever holds the address can set its PTR record, usually the hosting or internet provider.
How do I check if a domain uses DNSSEC?
Look the domain up and open More records. The DS card shows whether the parent zone vouches for a key, and the tool checks that the key it names is one the domain publishes in its DNSKEY records. A DNSSEC badge also shows when the resolver checked the signatures. Look up the top of the domain, like example.com, since DS and DNSKEY records don't exist at names like www.
Where do I find a DKIM selector?
Open the headers of an email the domain sent and find the DKIM-Signature line. The s= tag is the selector and the d= tag is the domain. DNS has no way to list selectors, so the tool can't guess them. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2.

Related tools

Subnet Calculator

Calculate network address, broadcast address, and usable IP ranges for IPv4/IPv6.

Use tool

Text Encoding Converter

Convert text to Base64, binary, hex, URL encoding and HTML entities, and back again.

Use tool

Open Graph Visualizer

Preview how your website links will look when shared on Google, Twitter, Facebook, and Discord.

Use tool

JWT Decoder & Validator

Decode JWT headers and claims, check exp, nbf and iat, and verify signatures locally with your own key.

Use tool

Use this tool on your own site

Drop the DNS Lookup into your blog, docs, or CMS with one iframe snippet. Free, no signup. See all embeddable tools