Look up the DNS records behind any domain name: its addresses, mail servers, name servers, text records and certificate authority rules. Answers come from Google Public DNS over an encrypted connection, and every record is shown with the time-to-live the resolver reported.
Enter a domain without https://, such as gmail.com. Subdomains work too, for example mail.google.com, and so do names that begin with an underscore, such as _dmarc.example.com.
Record type
A DNS lookup tells you what records a domain carries, as one resolver currently sees them. Enter any domain to see its A, AAAA, CNAME, MX, TXT, NS, SOA or CAA records with the TTL the resolver returned. Answers come from Google Public DNS through its JSON API for DNS over HTTPS, so each answer is that resolver's cached view and may differ from what the domain's own name servers hold.
What Is a DNS Lookup and What Does This Tool Do?
What does this tool do?
You give it a domain name and choose a record type, and it returns every matching record with the time-to-live the resolver reported. It handles the eight types most people need: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA. The All types option runs all eight in sequence, one query each, which is the quickest way to see the whole shape of a zone at once; if the first answer says the domain does not exist, the run stops there instead of asking the same question eight times.
It also distinguishes the two very different kinds of nothing: a domain that does not exist returns NXDOMAIN, while a domain that exists but has no record of the type you asked for returns an empty answer and no error at all.
Why is this useful?
DNS is a useful first check when a site or a mailbox misbehaves, because many services depend on name resolution. A missing A record can prevent IPv4 access, while an incorrect AAAA or CNAME path can cause other resolution failures. A stale TXT record can make an SPF check fail and contribute to delivery problems, while the TTL helps explain how long an older answer may remain cached after a change.
Who uses this tool?
• Web developers: confirm a domain points at the right server after a move or a new deployment.
• Email administrators: read MX for the servers that accept your mail, TXT for SPF, and _dmarc. in front of the domain for DMARC.
• People changing hosts: watch a record change take effect and see how long the old TTL keeps the old answer alive.
• Security researchers: read CAA records to see which certificate authorities a domain permits.
• Anyone diagnosing "site not found": tell a DNS problem apart from a server problem in one step.
How Do You Use This Tool?
1. Type a domain name into the field, without https:// and without a path. A full URL or an email address is accepted too: everything except the name itself is stripped before the query goes out, and the cleaned name is shown in the result.
2. Pick a record type from the row of buttons, or choose All types to run all eight, one query per type.
3. Press Look up, or just hit Enter. The buttons lock while a lookup is running, and All types shows which type it is on as it works through them.
4. Read the status line first. It tells you whether the domain exists, whether it has records of the type you asked for, and whether the question reached the resolver at all.
5. Use Copy result to paste the whole set of records into a ticket. Recent lookups remembers the record type along with the name, so clicking an entry repeats that exact lookup rather than the one currently selected.
Example: an address lookup and a mail lookup
At the time of review, asking for the A records of dns.google returned two rows: 8.8.4.4 and 8.8.8.8, with a TTL of 190 seconds. Two records for one name is common and usually healthy: clients typically pick one and may try the other if it fails. TTLs and record order can change, so run the lookup yourself to see the current values.
At the time of review, asking for the MX records of gmail.com returned five records with priorities 5, 10, 20, 30 and 40; the resolver reported a TTL of 3072 seconds. The number in front is the priority, and lower values are preferred. The resolver may return the five records in a different order, so the page does not rely on display order. If your own domain returns no MX rows at all, mail delivery has no MX target to use. Records change, so run the lookup yourself to see the current values.
Where the answer on this page comes from
The two accent-coloured boxes at the top are the only parts this tool can observe. Everything below them happens inside Google's resolver, which is why a record you changed a minute ago can still come back with its old value until the TTL runs out.
How Do You Read the Results?
Status
The resolver's verdict, in plain words. Records found means data came back. No records of this type means the domain exists but carries nothing of what you asked for. Domain does not exist is the NXDOMAIN answer. Server failure and Query refused mean the resolver answered with an error instead of a record. That often points at the domain's name servers or their policy. A server failure can also come from a DNSSEC validation problem, because Google Public DNS validates DNSSEC by default, and this page does not display the reason text the resolver may attach. The lookup did not complete means the page could not obtain a usable response from dns.google. It can happen because of a network problem, filter, browser setting, extension or HTTP-level failure, and it does not establish anything about the domain itself.
Domain and record type
The name that was actually queried and the type asked for. The domain appears after cleaning, so if you paste a full URL or an email address you can see the bare name that was sent.
The record rows
One row per record, labelled with the type it really is rather than the type you asked for. MX rows begin with a priority number, where lower wins. Long TXT records arrive from the resolver as several quoted pieces and are joined back together here.
All types
Eight separate queries, sent one after another, with a progress line while they run. A type that holds nothing gets a row saying so, which is an answer in itself. A resolver chases an alias for every type it is asked about, so the same CNAME comes back inside several of the eight answers; it is listed once rather than eight times, the type it was collapsed out of says it was already listed above, and the record count reflects that. If the domain turns out not to exist the run stops after the first query.
TTL
Time to live, in seconds, as the resolver reported it: the countdown until this cached copy expires, not the value published by the domain's own server, which is why it usually shrinks between repeated lookups. A TTL of 3600 means a change can take up to an hour to appear here.
No records against domain does not exist
These look similar and mean opposite things. No records of this type means the name is registered and answering, it simply has nothing of that type, which is normal: many domains have no CAA record. Domain does not exist means the name is not in DNS at all, so check the spelling, then the registration.
A CNAME in an A lookup
Ask for the A record of an alias and the resolver returns the CNAME first, then the addresses it eventually points to. That is correct behaviour, not an error, and each row is labelled with what it really is.
Status messages compared
| Status shown | What it usually means | What to check next |
|---|---|---|
| Records found | The resolver returned at least one record. | Read the rows and the TTL. An A lookup that returns only a CNAME row and no address can still say "Records found", so look for the address row. |
| No records of this type | The name answers normally but, as far as this resolver reports, has nothing of the type you asked for. | Often normal for CAA or AAAA. If you expected a record, check that it was added at the provider that actually runs the domain's name servers (the NS lookup shows who that is). |
| Domain does not exist | The resolver reports NXDOMAIN: the name is not in DNS, as far as it can tell. | Spelling first, then registration. A name created very recently may take a while to appear, since resolvers can cache a "does not exist" answer. |
| Server failure | The resolver could not produce a usable answer. | Often a name server problem, and sometimes a DNSSEC validation problem. Try again after a few minutes before assuming the zone is broken. |
| Query refused | A server declined to answer for policy reasons. | Check whether the domain's name servers are configured to serve the zone or otherwise allow the query. |
| The lookup did not complete | The page could not obtain a usable response from dns.google. | Look at your network, filters, browser or extensions. It does not establish that anything is wrong with the domain. |
Example inputs and what the tool does with them
These results come from the page's own input-cleaning and validation code, run on each input. They show what is sent to the resolver, not a live answer for any domain.
| You type | Name sent to the resolver | Outcome |
|---|---|---|
| https://Example.COM/path?x=1 | example.com | Scheme, path, query string and capitals removed. |
| someone@example.com | example.com | Everything up to the @ removed. |
| example.com:8080 | example.com | Port removed. |
| _dmarc.example.com | _dmarc.example.com | Accepted: a leading underscore is allowed on a label. |
| example..com | none | Rejected as not a domain name (empty label). |
| localhost | none | Rejected: a name needs at least one dot and a valid ending. |
Example rows and how they are displayed
The values below use reserved documentation names and addresses (example.com, 192.0.2.0/24), so they illustrate formatting only. Real records for any domain differ and change over time.
| Example value and TTL | Row text on this page |
|---|---|
| TXT "v=spf1 ip4:192.0.2.0/24 " "~all", TTL 300 | v=spf1 ip4:192.0.2.0/24 ~all with TTL 300 s (5 minutes). Quotes are stripped and the pieces joined. |
| MX 10 mail.example.com., TTL 3600 | Shown as returned, including the trailing dot, with TTL 3600 s (1 hour). The 10 is the priority. |
| Any record, TTL 45 | TTL 45 s. Under a minute, no unit conversion is added. |
| Any record, TTL 129600 | TTL 129600 s (1.5 days). |
What this tool cannot tell you
• It sees one resolver, not the whole internet. Every answer comes from Google Public DNS. Your provider's resolver may hold something different, and the domain's authoritative server is never contacted from here.
• Answers can be cached, and therefore stale. A change made moments ago may not appear until the previous TTL expires. This is not a propagation checker: it cannot tell you what resolvers in other countries are serving.
• It does not report DNSSEC validation. Whether a zone is signed, and whether the signature checked out, is not shown.
• It does not list a domain's subdomains. DNS has a zone-transfer request (AXFR), but most authoritative servers refuse it to strangers, and this tool does not offer zone transfers. Subdomains generally have to be known before they can be looked up here.
• The buttons cover eight types, not all of them. A, AAAA, CNAME, MX, TXT, NS, SOA and CAA answer nearly every real question. Types like SRV, PTR and HTTPS exist and are simply not on the list.
How the DNS Answer Is Worked Out
Each lookup on this page is a single question to one resolver, followed by some cleanup before the rows are drawn. The cleanup is not cosmetic: without it, a TXT record would print with quote marks around it and the same CNAME would appear eight times in an All types run. The steps below run in this order every time.
1. The input is reduced to a bare name
Whatever you paste is stripped down to the name itself before any query goes out. The scheme (https://), any path or query string, a port number, a trailing dot and everything up to and including an @ are all removed, and capitals are lowered. That last removal is what lets an email address like someone@example.com work: only the part after the @ is queried. The cleaned name is written back into the input field and shown in the result's Domain row, so the two should not disagree.
Validation uses a pattern of this page's own rather than the shared one, because the shared one rejects an underscore in a label and _dmarc.example.com is one of the names people most often need to look up. The pattern allows a single leading underscore on any label, a total of 253 characters, and either an alphabetic suffix of two or more letters or a punycode suffix such as xn--p1ai.
2. The type is turned into a numeric query
DNS asks for records by number, not by letter. Each of the eight buttons maps to the code the resolver expects: A is 1, AAAA is 28, CNAME is 5, MX is 15, TXT is 16, NS is 2, SOA is 6 and CAA is 257. The response comes back with those same numbers, and the page translates them back to letters so every row reads with the type it really is. A CNAME that arrives inside an A answer therefore gets its own correct label rather than being mislabelled as an address.
3. One query, or eight in sequence
A single-type lookup sends one request to dns.google/resolve. All types sends eight, one per record type, in the fixed order A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, with a progress line naming the type it is on. The run stops early if any answer carries a status of 3 (NXDOMAIN), because once the name is known not to exist the remaining seven questions would only repeat the same answer.
A resolver chases an alias every time it is asked about one, so a single CNAME comes back inside several of the eight answers. The page collapses identical rows across the whole run, but remembers how many rows each type arrived with. That second part matters: without it, a type whose only row was a duplicate would print as no records just below the very row that had been kept, and the page would contradict itself on any alias. Deduplication runs on an All types lookup only; inside a single answer a repeated record is a fault worth seeing.
4. The resolver's status becomes one of four outcomes
Every answer carries a status code, and the status line above the rows is built from that code rather than from whether rows came back. The four outcomes are read in this order:
- 3, domain does not exist. Reported as Domain does not exist regardless of how many queries were sent. This is the NXDOMAIN answer, and it is about the name, not the type.
- At least one record returned. Reported as Records found, in green. The count of rows across all queries is what decides this, not the presence of a status alone.
- An error code of 1, 2, 4 or 5. Reported with the resolver's own meaning — The query was malformed, Server failure, Query type not supported, or Query refused. These are resolver-level errors; depending on the code, the cause can be with the query, the resolver, or the domain's DNS service.
- No usable response arrived, marked internally as status -1. Reported as The lookup did not complete. This means the page could not obtain a usable response from dns.google; a network problem, filter, browser setting, extension or HTTP-level failure can cause it.
A status of 0 — a normal answer that carried no records of the type asked for — falls through to the neutral message No records of this type, which is deliberately not the same statement as Domain does not exist. The note under the rows is built from the same four tests in the same order, so it should not describe a different outcome from the status line above it.
5. Two formatting rules before a row is drawn
TXT records. The resolver returns a TXT value as one or more quoted strings, and a long record arrives as several quotes that belong end to end. The surrounding quotes are stripped and the pieces are joined back into one string, so the row reads as the value the domain published rather than as the wire format.
Time to live. The TTL is shown twice: once as the raw seconds the resolver returned, and once in the largest unit that fits, so 3600 reads as 3600 s (1 hour). That figure is the countdown on the resolver's cached copy, not the value published by the domain's own name server, which is why it usually shrinks between repeated lookups (it can jump back up when the resolver refreshes the record, or when a different cache node answers). When it reaches zero the resolver fetches the record again and the number resets to the published value.
When Would You Use This Tool?
Moving to a new host
Check that A and AAAA now hold the new server's address, and read the TTL to see how long the old one can still be served.
Mail bouncing or going to spam
Read MX to see which servers accept your mail, then TXT for SPF. DMARC does not live at the domain itself: look up _dmarc. in front of it.
Verifying domain ownership
Services hand you a TXT string to publish. Confirm it is live here before you press verify on their side.
Changing name servers
NS tells you which provider is actually in charge of the zone, which is often not the company you bought the domain from.
A certificate will not issue
CAA lists the certificate authorities permitted to issue for the name. If no applicable CAA is found at the name or its parents, CAA does not restrict which certificate authority may issue.
"Site cannot be reached"
If the A records are present and the name resolves as expected, basic DNS resolution is working and the fault may lie further along the path. Test the address with the ping tool next.
What Does Each Record Type Hold?
Each record type has a numeric code in the DNS protocol, and the resolver returns that code rather than the letters. The tool translates it back so every row is labelled with the type it really is. Codes come from the IANA DNS parameters registry; the record format itself is defined in RFC 1035.
| Type | Code | What the record holds |
|---|---|---|
| A | 1 | An IPv4 address for the name |
| AAAA | 28 | An IPv6 address for the name |
| CNAME | 5 | Another name to follow instead |
| MX | 15 | A mail server plus a priority, lower first |
| TXT | 16 | Free text, used for SPF, DMARC and verification |
| NS | 2 | The name servers responsible for the zone |
| SOA | 6 | The zone's serial number and timing values |
| CAA | 257 | Which certificate authorities may issue for the name; a CA also checks parent names if the exact name has none |
What If DNS Is Fine but the Site Still Fails?
DNS only helps resolve names to addresses. Once the expected A/AAAA/CNAME resolution is working, the problem may have moved somewhere else: the server may be refusing connections, or the route to it may be broken. The next question is whether the address answers at all, which the ping tool measures from your own browser. To find out who owns the address a record points at, run it through the IP address lookup.
About the data
Every answer comes from one source: Google Public DNS, queried at dns.google through its JSON API for DNS over HTTPS. There is no fallback resolver. If dns.google cannot be reached from your browser, the page says the lookup did not complete instead of trying another service.
Results are fetched live each time you press Look up, but the resolver may answer from its cache until a record's TTL runs out. Google will see the name you look up, as it would if you used 8.8.8.8 as your resolver, and All types sends eight such queries rather than one. The tool itself does not save lookups on a server; the recent lookups list lives in your own browser and the Clear button deletes it. Ordinary web hosting and analytics logs for visiting this page are separate from that.
The explanations on this page were last reviewed on October 2, 2026. Google's own documentation for the API was last updated in September 2024 at the time of review, so check it for current behaviour.
What Other Tools Work With This One?
Sources and Further Reading
These are the references behind the explanations on this page.
• Google Public DNS: JSON API for DNS over HTTPS. The exact interface this tool calls: the name and type parameters, the Status field, the Answer list and TTL values, and the note that DNSSEC validation is on unless disabled.
• Google Public DNS: DNS-over-HTTPS (DoH). General behaviour of the service, including the point that an HTTP success can still be a DNS failure, so the DNS status must be read.
• RFC 1035: Domain names, implementation and specification. Record formats (A, NS, CNAME, SOA, MX, TXT), TTL, and the response codes behind the status messages.
• RFC 8659: DNS Certification Authority Authorization (CAA). What a CAA record means and how a certificate authority searches up the name tree for one.
• IANA DNS parameters registry. The official list of record type numbers.
Frequently Asked Questions
What is a DNS lookup?+
It is a question put to the domain name system about what records a name carries. Every time you open a website your device performs one automatically to turn the name into an address. This page lets you send that question yourself and read the raw answer, including record types your browser never asks for, such as MX and CAA.
Which resolver does this tool ask?+
Google Public DNS, reached at dns.google through its JSON API for DNS over HTTPS, an encrypted connection. That is one recursive resolver, not the whole internet, so the answer you see is whatever Google currently holds. Your own internet provider's resolver may hold something slightly different, and the domain's authoritative server is never contacted directly from this page.
Why does the record I just changed not show up?+
Because the resolver is still serving the previous answer from its cache. It keeps a copy for the length of the record's time to live and will not ask again until that expires, so a record with a one hour TTL can keep returning the old value for up to an hour. Lowering the TTL a day before a planned change shortens that window.
What does the TTL number mean?+
Time to live, in seconds. It is the countdown until the resolver's cached copy expires rather than the value published by the domain's own name server, which is why it usually shrinks between repeated lookups (it can jump back up when the resolver refreshes the record, or when a different cache node answers). When it reaches zero the resolver fetches the record again and the number resets to the published value.
What is the difference between no records of this type and domain does not exist?+
They mean opposite things. No records of this type means the domain is registered and answering normally, it simply carries nothing of the type you asked for, which is ordinary since many domains have no CAA record. Domain does not exist means the name itself is not in DNS at all, so the first thing to check is the spelling and the second is whether the registration is still active.
Why does an A lookup return a CNAME row?+
Because the name you asked about is an alias. The resolver returns the CNAME that points elsewhere, followed by the addresses that name eventually resolves to, and both belong in the same answer. This tool labels each row with its real record type instead of presenting the alias as though it were an address.
Can I list all the subdomains of a domain?+
Not reliably. DNS has a zone transfer request (AXFR) that asks a name server for a whole zone, but most servers refuse it from strangers, and this tool does not offer it. Subdomains generally have to be known before they can be looked up, one name at a time.
Which record types can I look up here?+
Eight of them: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA. Between them they answer nearly every practical question about a zone, and the All types option runs all eight in sequence. Less common types such as SRV, PTR and HTTPS exist in DNS but are not offered on this page.
How the DNS Lookup Works
What it measures: The records published for a domain, such as A, AAAA, CNAME, MX, TXT, NS and SOA, shown as a DNS resolver returned them.
What it is based on: DNS is defined in RFC 1034 and RFC 1035. CAA records (RFC 8659) say which certificate authorities may issue certificates for a domain, and SPF policies are published in TXT records (RFC 7208).
Limits of the result: Resolvers cache answers for the time set in each record's TTL, so a recent change can take time to show everywhere and two resolvers may briefly disagree. The tool shows what was returned at that moment, not what every resolver in the world would return.
Sources: RFC 1034 (DNS concepts) · RFC 1035 (DNS implementation) · RFC 8659 (CAA) · RFC 7208 (SPF)
Last reviewed October 2026 · Editorial Policy · How our tools work
Comments:
Post a Comment