DNS Lookup

Check the DNS records of any domain: the IP addresses of its servers, where its email goes, its name servers and its TXT records. Enter an IP address for a reverse DNS lookup.

Domain, URL or IP address

Record type

DNS resolver

Try:

Enter a domain above to see its DNS records. Results come live from the resolver you choose, with nothing stored on this site.

What Is a DNS Lookup?

DNS, the Domain Name System, is the internet's address book. Computers connect to each other by IP address, so before your browser can open a website it asks a DNS resolver for the address behind the name. That question and its answer are a DNS lookup.

A domain publishes more than its website's address. Its DNS records also say where its email should be delivered, which companies may issue its SSL certificates, and which services it uses. Anyone can read these records, and this tool shows them in one place.

DNS Record Types Explained

Record	What it does	Example
A	Points the name to an IPv4 address, the server that hosts the website.	`203.0.113.10`
AAAA	The same for IPv6. Phones and home connections with IPv6 often use it first.	`2001:db8::10`
CNAME	Makes the name an alias of another name, common for www and for sites hosted on Shopify, Squarespace or a CDN.	`shops.myshopify.com`
MX	Lists the mail servers that accept email for the domain. The lowest priority number is tried first.	`1 smtp.google.com`
NS	Names the DNS servers in charge of the domain, usually your registrar, web host or Cloudflare.	`ns1.example-dns.com`
TXT	Free text, used for SPF and DMARC email rules and to prove domain ownership to Google, Microsoft and others.	`v=spf1 include:_spf.google.com -all`
SOA	Basic facts about the zone: primary name server, admin contact, serial number and cache timers.	`ns1.example-dns.com. 2026102101`
CAA	Says which certificate authorities may issue SSL certificates for the domain.	`0 issue "letsencrypt.org"`
SRV	Points a specific service, such as calling or chat, to a server and port.	`100 1 443 sipdir.online.lync.com`
PTR	Reverse DNS: turns an IP address back into a hostname. Mail servers check it to fight spam.	`dns.google`

Every record also has a TTL (time to live): how long resolvers may keep a copy before they ask again. It's shown next to each record in the result.

When to Check DNS Records

Moving a Website to a New Host

After you update the A record or the name servers, look up the domain to confirm it points to the new server's IP address. If one resolver shows the new address and the other the old one, the change is still spreading (see propagation below).

Setting Up or Fixing Email

If email to your domain bounces, check the MX records first. They must point to your email provider, for example smtp.google.com for Google Workspace or yourdomain-com.mail.protection.outlook.com for Microsoft 365. Then check the TXT records for SPF, and run the SPF, DKIM & DMARC Checker to make sure Gmail and Yahoo will accept your messages.

Verifying Domain Ownership

Google Search Console, Microsoft 365, Apple, Meta and many other services ask you to add a TXT record to prove you own a domain. Once you've added it, select TXT and look the domain up here. When the record appears, the service will be able to see it too.

SSL Certificate Won't Issue

If Let's Encrypt or another certificate authority refuses to issue a certificate, look at the CAA records. When a domain has CAA records, only the authorities listed there may issue certificates. No CAA record at all means any authority may.

Checking a Suspicious Link

Before you trust a link from an email or a text message, look up the domain. A missing domain (NXDOMAIN), a brand-new setup or an IP address in an unexpected country are warning signs. Click an IP address in the result to open it in the IP Address Lookup, or check who registered it with the WHOIS Lookup.

DNS Propagation: Why Changes Take Time

DNS changes don't spread like an update. Resolvers at internet providers, companies and services like Cloudflare and Google keep each answer for the length of its TTL. Until that time runs out, they keep handing out the old record. That delay is what people call DNS propagation.

A, AAAA, CNAME, MX, TXT: usually minutes to an hour, because most providers use a TTL of 5 minutes to 1 hour.
Name server (NS) changes: up to 24 to 48 hours. The NS records at the registry for .com and .net have a TTL of two days.
A brand-new domain: usually live within minutes to a few hours of registration.

Planning a move? Lower the TTL of the records you'll change to 300 seconds (5 minutes) a day before the switch. After the move, raise it back to an hour or more.

To compare, run the lookup once with Cloudflare and once with Google. If both show the new record, most of the internet sees it too.

Still Seeing the Old Website? Clear Your DNS Cache

Your computer and browser keep their own copy of DNS answers. If this tool shows the new address but your browser still opens the old site, clear the local cache:

Windows: open Command Prompt and run:

ipconfig /flushdns

Mac: open Terminal, run this command and enter your Mac password when asked (nothing appears on screen as you type it):

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Chrome and Edge: open chrome://net-internals/#dns (or edge://net-internals/#dns) and click Clear host cache
Phone: turn airplane mode on and off, or restart the phone

Why Results Can Differ From What You See

Large sites give different answers in different places. Google, Netflix and most big sites send each visitor to a nearby server, so the IP addresses depend on where the resolver is. This tool asks Cloudflare or Google, not your internet provider.
Cloudflare and other proxies hide the real server. A site behind Cloudflare shows Cloudflare's IP addresses, not those of the host that actually runs the site.
Internal names only exist inside a network. Company intranet names and local names such as printer.local are answered inside the network and won't show up in a public lookup.
Your provider or router may use its own DNS. Comcast Xfinity, Spectrum, AT&T and other US providers run their own resolvers, which may still hold an older copy.

How to Do a DNS Lookup on Windows, Mac and Linux

You can run the same query from your own computer, which asks the DNS server your device actually uses.

Windows: nslookup

Open Command Prompt or PowerShell. The second line asks Google's resolver for the MX records:

nslookup example.com
nslookup -type=MX example.com 8.8.8.8

PowerShell also has Resolve-DnsName example.com -Type TXT, which shows TTLs in a cleaner table.

Mac and Linux: dig

Open Terminal. +short prints only the values, -x does a reverse lookup:

dig example.com
dig example.com MX +short
dig @1.1.1.1 example.com TXT
dig -x 8.8.8.8 +short

Who Can See Your Own DNS Lookups?

Every site you visit starts with a DNS lookup, so whoever runs your DNS resolver can see a list of the domains you visit. By default that's your internet provider. A VPN should send these lookups through its tunnel, but a misconfigured one can leak them.

The DNS Leak Test shows which resolvers your device really uses. To keep your provider from seeing your lookups without a VPN, turn on DNS over HTTPS in your browser.

The Verdict: DNS Shows Where a Domain Really Points

A DNS lookup is the quickest way to check a website move, an email setup or a verification record. If the record is right here, it's right on the internet. If it isn't, wait out the TTL before changing anything again.

Your own lookups say a lot about you. Each one reveals a site you visit to whoever runs your resolver, so it's worth checking that your VPN keeps them private.

Test Your DNS for Leaks

Frequently Asked Questions

What is a DNS lookup?

A DNS lookup asks the Domain Name System for the records published for a domain name. The best known is the A record, which turns a name like example.com into the IP address of its server. Other records say which servers handle the domain's email (MX), which name servers are in charge of it (NS), and hold text used for email security and ownership checks (TXT).

How do I check the DNS records for a domain?

Type the domain into the box at the top of this page, leave the record type on "All common records" and click Look Up. You'll see every A, AAAA, CNAME, MX, NS, TXT, SOA and CAA record with its TTL. On your own computer you can run nslookup on Windows or dig on a Mac or Linux.

How long does DNS propagation take?

Most changes show up worldwide within an hour, and almost all within 24 to 48 hours. The time depends on the TTL of the old record: resolvers that cached it keep using it until the TTL runs out. Changing a domain's name servers takes longest, because the NS records at the registry often have a TTL of one or two days.

What does NXDOMAIN mean?

NXDOMAIN means the domain name doesn't exist in DNS. Usually the name is misspelled, the domain has expired, or it was never registered. A brand-new domain can also return NXDOMAIN for a short while until the registry publishes it.

Why do Cloudflare and Google DNS show different results?

Each resolver keeps its own cache. Right after a change, one may still hold the old record until its TTL expires. Large sites also return different IP addresses depending on where the resolver is, to send you to a nearby server. Different results are normal in both cases, and they settle once the TTL has passed.

What's the difference between a DNS lookup and a WHOIS lookup?

A DNS lookup shows where a domain points: its server IP addresses, mail servers and name servers. A WHOIS lookup shows who an IP address or domain is registered to, along with the registry and abuse contact. Use the WHOIS Lookup for that.

Is this DNS lookup free and private?

Yes. It's free with no signup and no limit. Your browser sends the query directly to Cloudflare or Google over encrypted DNS-over-HTTPS. The domains you look up never reach this site's server and are not logged or stored.