DNS Lookup
Query DNS records for any domain over DNS-over-HTTPS. Choose a record type and resolver, and view answers, TTLs, status, DNSSEC state, and raw JSON.
Your input is used for this one lookup only. It is not logged or stored.
Results
How to read the results
Each answer row shows the record name, type, TTL and data. The status badge reflects the DNS response code (NOERROR, NXDOMAIN, SERVFAIL, and so on).
Records and DNSSEC signatures are counted separately
We ask resolvers for DNSSEC material, so a signed zone answers with RRSIG records alongside the records you asked for. An RRSIG is a cryptographic signature over a record set — it is not another A or MX record. Mixing them in would mean a domain with two A records and one signature reported "3 records", which is why signatures live in their own collapsible DNSSEC signatures section and never change the record count.
- Authenticated (AD) — the resolver validated the DNSSEC chain for this answer.
- Signed, not validated — signatures came back but the resolver did not set the AD bit (it may not be validating, or validation did not succeed).
- Unsigned — the zone publishes no DNSSEC material at all. This is normal for most domains.
How to use it
- Enter a domain (internationalized names are supported).
- Pick a record type and, optionally, a resolver.
- Look up, then copy a single value, Copy all, Download CSV, Download JSON, or open the raw resolver response.
- Use Share to copy a link that reproduces the same lookup.
Common issues & statuses
- NXDOMAIN — the domain does not exist. Check spelling.
- SERVFAIL — the resolver failed (often DNSSEC or delegation misconfiguration). Try another resolver to tell the two apart.
- No records — the domain exists but has none of that type.
- Timeout / Resolver error — try again or switch resolver.
- Unknown (TYPE n) — the resolver returned a record type we do not have a name for. The number is the IANA type code and the data is shown as the resolver sent it.
Data source: Public DNS-over-HTTPS resolvers. Queries go to the selected public resolver; results reflect that resolver’s cache. Learn about our data sources →
Read more
- Why DNS changes take time: propagation and TTL explained — Propagation is not a broadcast — it is caches expiring. Here is how TTL controls the wait, and how to plan a migration around it.
Frequently asked questions
What is the difference between "No records" and NXDOMAIN?
What does TTL mean?
Why do TXT records show SPF/DKIM/DMARC badges?
What are the DNSSEC signatures shown below the records?
RRSIG records proving the answer has not been tampered with. They are signatures about your records, not extra records, so they are listed separately and are not included in the record count.