Look up the DNS records behind any domain name: its addresses, mail servers, name servers, text records and certificate authority rules. Answers come from Google Public DNS over an encrypted connection, and every record is shown with the time-to-live the resolver reported.
Enter a domain without https://, such as gmail.com. Subdomains work too, for example mail.google.com, and so do names that begin with an underscore, such as _dmarc.example.com.
Record type
A DNS lookup tells you what records a domain actually carries. Enter any domain to see its A, AAAA, MX, TXT, NS, SOA or CAA records with the exact TTL the resolver returned. Answers come from Google Public DNS over DNS over HTTPS, so each one is that resolver's cached view.
What Is a DNS Lookup and What Does This Tool Do?
What does this tool do?
You give it a domain name and choose a record type, and it returns every matching record with the time-to-live the resolver reported. It handles the eight types most people need: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA. The All types option runs all eight in sequence, one query each, which is the quickest way to see the whole shape of a zone at once; if the first answer says the domain does not exist, the run stops there instead of asking the same question eight times.
It also distinguishes the two very different kinds of nothing: a domain that does not exist returns NXDOMAIN, while a domain that exists but has no record of the type you asked for returns an empty answer and no error at all.
Why is this useful?
DNS is the first thing to check when a site or a mailbox misbehaves, because almost everything else depends on it. A missing A record means nothing can reach the site no matter how healthy the server is. A stale TXT record means an SPF check fails and your messages land in spam. Reading the records directly turns guesswork into a fact, and the TTL tells you how long a mistake will keep being served after you fix it.
Who uses this tool?
• Web developers: confirm a domain points at the right server after a move or a new deployment.
• Email administrators: read MX for the servers that accept your mail, TXT for SPF, and _dmarc. in front of the domain for DMARC.
• People changing hosts: watch a record change take effect and see how long the old TTL keeps the old answer alive.
• Security researchers: read CAA records to see which certificate authorities a domain permits.
• Anyone diagnosing "site not found": tell a DNS problem apart from a server problem in one step.
How Do You Use This Tool?
1. Type a domain name into the field, without https:// and without a path. A full URL or an email address is accepted too: everything except the name itself is stripped before the query goes out, and the cleaned name is shown in the result.
2. Pick a record type from the row of buttons, or choose All types to run all eight, one query per type.
3. Press Look up, or just hit Enter. The buttons lock while a lookup is running, and All types shows which type it is on as it works through them.
4. Read the status line first. It tells you whether the domain exists, whether it has records of the type you asked for, and whether the question reached the resolver at all.
5. Use Copy result to paste the whole set of records into a ticket. Recent lookups remembers the record type along with the name, so clicking an entry repeats that exact lookup rather than the one currently selected.
Example: an address lookup and a mail lookup
Asking for the A records of dns.google returns two rows: 8.8.8.8 and 8.8.4.4, each with a TTL in the region of 900 seconds. Two records for one name is normal and healthy: resolvers pick one, and if it fails they try the other.
Asking for the MX records of gmail.com returns five rows led by 5 gmail-smtp-in.l.google.com, then alt1 at 10, alt2 at 20, alt3 at 30 and alt4 at 40. The number in front is the priority, and lower wins: a sending server tries 5 first and works down the list. If your own domain returns no MX rows at all, mail sent to it has nowhere to go.
Where the answer on this page comes from
The two accent-coloured boxes at the top are the only parts this tool can observe. Everything below them happens inside Google's resolver, which is why a record you changed a minute ago can still come back with its old value until the TTL runs out.
How Do You Read the Results?
Status
The resolver's verdict, in plain words. Records found means data came back. No records of this type means the domain exists but carries nothing of what you asked for. Domain does not exist is the NXDOMAIN answer. Server failure and Query refused mean the resolver answered with an error instead of a record, which points at the domain's name servers rather than at your query. The lookup did not complete is about this browser rather than the domain: the request never reached dns.google, which is what you see when a network, a filter or an extension blocks DNS over HTTPS, and it tells you nothing at all about the name you typed.
Domain and record type
The name that was actually queried and the type asked for. The domain appears after cleaning, so if you paste a full URL or an email address you can see the bare name that was sent.
The record rows
One row per record, labelled with the type it really is rather than the type you asked for. MX rows begin with a priority number, where lower wins. Long TXT records arrive from the resolver as several quoted pieces and are joined back together here.
All types
Eight separate queries, sent one after another, with a progress line while they run. A type that holds nothing gets a row saying so, which is an answer in itself. A resolver chases an alias for every type it is asked about, so the same CNAME comes back inside several of the eight answers; it is listed once rather than eight times, the type it was collapsed out of says it was already listed above, and the record count reflects that. If the domain turns out not to exist the run stops after the first query.
TTL
Time to live, in seconds, as the resolver reported it: the countdown until this cached copy expires, not the value published by the domain's own server, which is why it shrinks each time you look. A TTL of 3600 means a change can take up to an hour to appear here.
No records against domain does not exist
These look similar and mean opposite things. No records of this type means the name is registered and answering, it simply has nothing of that type, which is normal: most domains have no CAA record. Domain does not exist means the name is not in DNS at all, so check the spelling, then the registration.
A CNAME in an A lookup
Ask for the A record of an alias and the resolver returns the CNAME first, then the addresses it eventually points to. That is correct behaviour, not an error, and each row is labelled with what it really is.
What this tool cannot tell you
• It sees one resolver, not the whole internet. Every answer comes from Google Public DNS. Your provider's resolver may hold something different, and the domain's authoritative server is never contacted from here.
• Answers can be cached, and therefore stale. A change made moments ago may not appear until the previous TTL expires. This is not a propagation checker: it cannot tell you what resolvers in other countries are serving.
• It does not report DNSSEC validation. Whether a zone is signed, and whether the signature checked out, is not shown.
• It cannot list a domain's subdomains. DNS has no show-me-everything query available to strangers, so a subdomain has to be known before it can be looked up.
• The buttons cover eight types, not all of them. A, AAAA, CNAME, MX, TXT, NS, SOA and CAA answer nearly every real question. Types like SRV, PTR and HTTPS exist and are simply not on the list.
When Would You Use This Tool?
Moving to a new host
Check that A and AAAA now hold the new server's address, and read the TTL to see how long the old one can still be served.
Mail bouncing or going to spam
Read MX to see which servers accept your mail, then TXT for SPF. DMARC does not live at the domain itself: look up _dmarc. in front of it.
Verifying domain ownership
Services hand you a TXT string to publish. Confirm it is live here before you press verify on their side.
Changing name servers
NS tells you which provider is actually in charge of the zone, which is often not the company you bought the domain from.
A certificate will not issue
CAA lists the certificate authorities permitted to issue for the name. A CAA record that omits your authority blocks it.
"Site cannot be reached"
If the A records are present and correct, DNS is not your problem and the fault lies further along the path.
What Does Each Record Type Hold?
Each record type has a numeric code in the DNS protocol, and the resolver returns that code rather than the letters. The tool translates it back so every row is labelled with the type it really is. Codes come from the IANA DNS parameters registry; the record format itself is defined in RFC 1035.
| Type | Code | What the record holds |
|---|---|---|
| A | 1 | An IPv4 address for the name |
| AAAA | 28 | An IPv6 address for the name |
| CNAME | 5 | Another name to follow instead |
| MX | 15 | A mail server plus a priority, lower first |
| TXT | 16 | Free text, used for SPF, DMARC and verification |
| NS | 2 | The name servers responsible for the zone |
| SOA | 6 | The zone's serial number and timing values |
| CAA | 257 | Which certificate authorities may issue for the name |
What If DNS Is Fine but the Site Still Fails?
DNS only hands out addresses. Once you can see a correct A record the name is doing its job, and the problem has moved somewhere else: the server may be refusing connections, or the route to it may be broken. The next question is whether the address answers at all, which the ping tool measures from your own browser. To find out who owns the address a record points at, run it through the IP address lookup.
About the data
Every query on this page goes to Google Public DNS at dns.google over DNS over HTTPS, so Google sees the name you look up in the same way it would if you used 8.8.8.8 as your resolver, and All types sends eight such queries rather than one. Nothing is stored on a server by this site: the recent lookups list lives in your own browser and the Clear button deletes it.
What Other Tools Work With This One?
Frequently Asked Questions
What is a DNS lookup?+
It is a question put to the domain name system about what records a name carries. Every time you open a website your device performs one automatically to turn the name into an address. This page lets you send that question yourself and read the raw answer, including record types your browser never asks for, such as MX and CAA.
Which resolver does this tool ask?+
Google Public DNS, reached at dns.google over an encrypted DNS over HTTPS connection. That is one recursive resolver, not the whole internet, so the answer you see is whatever Google currently holds. Your own internet provider's resolver may hold something slightly different, and the domain's authoritative server is never contacted directly from this page.
Why does the record I just changed not show up?+
Because the resolver is still serving the previous answer from its cache. It keeps a copy for the length of the record's time to live and will not ask again until that expires, so a record with a one hour TTL can keep returning the old value for up to an hour. Lowering the TTL a day before a planned change shortens that window.
What does the TTL number mean?+
Time to live, in seconds. It is the countdown until the resolver's cached copy expires rather than the value published by the domain's own name server, which is why it gets smaller each time you repeat the same lookup. When it reaches zero the resolver fetches the record again and the number resets to the published value.
What is the difference between no records of this type and domain does not exist?+
They mean opposite things. No records of this type means the domain is registered and answering normally, it simply carries nothing of the type you asked for, which is completely ordinary since most domains have no CAA record. Domain does not exist means the name itself is not in DNS at all, so the first thing to check is the spelling and the second is whether the registration is still active.
Why does an A lookup return a CNAME row?+
Because the name you asked about is an alias. The resolver returns the CNAME that points elsewhere, followed by the addresses that name eventually resolves to, and both belong in the same answer. This tool labels each row with its real record type instead of presenting the alias as though it were an address.
Can I list all the subdomains of a domain?+
Not through DNS. There is no query that asks a name server to hand a stranger the full contents of a zone, and servers that once allowed it were routinely abused. Subdomains have to be known before they can be looked up, one name at a time.
Which record types can I look up here?+
Eight of them: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA. Between them they answer nearly every practical question about a zone, and the All types option runs all eight in sequence. Less common types such as SRV, PTR and HTTPS exist in DNS but are not offered on this page.