DNS Lookup

Server assisted New DNS & Domains

Ask a public recursive resolver (Cloudflare 1.1.1.1 or Google Public DNS) for one record type of a domain and see the answer and authority sections, TTLs, the response code and the DNSSEC flag. The query is sent from the Mutqan server at the Cloudflare edge, so the result is what that resolver returns there, not necessarily what your own network sees.

Privacy: The name you look up is sent from the Mutqan server to the public DNS resolvers named in the results. Nothing is stored.

What is a DNS record?

A DNS record (resource record) is one entry in a zone: an owner name, a type such as A, MX or TXT, a TTL in seconds and the data for that type. Records of the same name and type form an RRset that resolvers fetch from the zone's authoritative servers and cache for the TTL, which is why a change becomes visible only as caches expire.

How to use DNS Lookup

  1. Type a domain name such as example.com (a pasted URL is reduced to its host name).
  2. Pick the record type and the resolver; tick "Request DNSSEC records" if you want signatures and the AD flag.
  3. Press Look up and read the summary: the response code tells you whether the name exists and the resolver answered.
  4. Check the answer table and the findings; download the table as CSV if you need it in a ticket.

DNS Lookup features

  • Sixteen record types: A, AAAA, CNAME, MX, NS, TXT, SOA, PTR, SRV, CAA, DS, DNSKEY, TLSA, HTTPS, SVCB and ANY
  • A choice of resolver — Cloudflare 1.1.1.1 or Google Public DNS — to spot an answer one cache still holds
  • Answer and authority sections with owner name, type, remaining TTL and data, downloadable as CSV
  • Plain-language findings for NXDOMAIN, NODATA, SERVFAIL and REFUSED, with the negative-caching TTL from the SOA
  • CNAME chains spelled out step by step, so you see which name actually holds the records
  • Optional DNSSEC request (DO bit) showing returned RRSIG signatures and the resolver's AD flag
  • An IP address is turned into its in-addr.arpa or ip6.arpa name for a PTR lookup automatically

Inputs and outputs

Inputs

  • Domain name or IP address — a host name (internationalised names are accepted), a name with underscore labels such as _dmarc.example.com, or an IPv4/IPv6 address, which becomes its reverse name.
  • Record type — one of the sixteen types listed; A is the default.
  • Resolver — Cloudflare 1.1.1.1 (default) or Google Public DNS.
  • Request DNSSEC records — sets the DO bit so signatures and the AD flag are returned.

Outputs

  • Summary — response code, number of answer records, lowest TTL, response time measured from the Cloudflare edge, the resolver used and, with DNSSEC on, the AD flag.
  • Answer section — every record returned (name, type, TTL in seconds, data), including the CNAME records of an alias chain.
  • Authority section — usually the SOA record of the zone when the answer is negative.
  • Findings — what the response code means, the alias chain, a cached copy close to expiry, truncation, the DNSSEC result and any comment the resolver attached.

DNS Lookup example

A records of a name that is an alias

Input:

www.wikipedia.org · type A · Google Public DNS

Output:

Response code: NOERROR — the resolver answered · Answer records: 2 · Lowest TTL: 90 s
Answer section:
www.wikipedia.org   CNAME  14286  dyna.wikimedia.org.
dyna.wikimedia.org  A      90     185.15.58.224
Findings: www.wikipedia.org is an alias (CNAME): www.wikipedia.org → dyna.wikimedia.org. The A records belong to the last name of the chain.

How to read the DNS Lookup results

NOERROR with records: the name exists and these are the records of the type you asked for, as cached by that resolver right now.

NOERROR with no records (NODATA): the name exists, but not with this type — for example a domain that has MX but no AAAA records. NXDOMAIN: the name does not exist for any type; check for a typo or a record that was never created.

SERVFAIL: the resolver tried and failed — DNSSEC validation errors, nameservers that time out and broken delegations are the usual causes. Try the other resolver and the Nameserver Checker.

TTL is the cache time left, not the configured value; two lookups seconds apart show a falling number. A TTL of a few seconds may only mean that this resolver's copy is about to expire — the Nameserver Checker shows the TTL the authoritative servers actually serve.

When to use DNS Lookup

  • Confirming that a new A, CNAME or TXT record is published before you point traffic or a verification check at it.
  • Reading the MX, SPF (TXT) and CAA records of a domain while debugging mail delivery or certificate issuance.
  • Comparing Cloudflare and Google to see whether one resolver still serves an old answer after a change.
  • Checking which name an alias finally resolves to when a CDN or SaaS provider asks you for a CNAME.

Troubleshooting

  • "This is not a valid domain name": remove spaces, the scheme and the path; only the host name is looked up (pasting a full URL is fine — the host is extracted).
  • Refused as a private or blocked name: internal names (.local, .internal, single-label names) and private addresses are never sent to public resolvers. Use dig or nslookup inside your own network for those.
  • NXDOMAIN for a record you just created: the resolver may hold the earlier negative answer for up to the negative TTL shown; wait that long or check the authoritative servers with the Nameserver Checker.
  • SERVFAIL on one resolver only: one of the two failed to validate or reach the zone; if it persists on both, the problem is in the zone or its delegation.

Frequently asked questions about DNS Lookup

Why does an ANY query not list all records of the domain?

Resolvers no longer answer ANY with every record. Cloudflare returns a single HINFO record, as RFC 8482 allows, and other resolvers minimise or refuse the query. Query each type you need (A, AAAA, MX, TXT, NS, CAA…) separately.

What is the difference between NXDOMAIN and an empty answer?

NXDOMAIN means the name does not exist at all. NOERROR with no answer records (often called NODATA) means the name exists but has no records of the type you asked for. Both are cached for the negative TTL taken from the zone's SOA record, which the tool shows from the authority section.

Why is the TTL lower than the value I configured?

A recursive resolver returns the time left before its cached copy expires, so the TTL counts down between lookups and only shows the full configured value right after the resolver fetched the record. The Nameserver Checker asks the authoritative servers directly and shows, in its TTL column, the value they serve — the configured one — for SOA, A, AAAA, MX, NS and TXT records.

Will I see the same answer as my own computer?

Not always. The query goes from the Mutqan server at the Cloudflare edge to the resolver you pick. Your own network may use another resolver with an older cached answer, a company DNS with internal records, or a CDN that answers by location.

What does "Request DNSSEC records" change?

It sets the DNSSEC OK (DO) bit, so the resolver also returns RRSIG signatures, and the AD flag in the summary tells you whether the resolver validated the answer. The tool reports what the resolver says; it does not re-verify the signatures itself.

Technical notes

The lookup is a recursive query over DNS-over-HTTPS (the JSON API of cloudflare-dns.com or dns.google) sent by the Mutqan Worker; the resolver follows the delegation from the root and returns the RRset with its remaining TTL. Record types and presentation formats follow RFC 1035 and the RFCs that added each type (RFC 3596 for AAAA, RFC 2782 for SRV, RFC 8659 for CAA, RFC 9460 for SVCB and HTTPS).

A negative answer carries the zone's SOA record in the authority section; RFC 2308 says resolvers cache NXDOMAIN and NODATA for the smaller of the SOA TTL and its minimum field, which is the figure the findings quote. ANY is answered with a minimal HINFO record by Cloudflare, as RFC 8482 permits.

Limitations and methodology

The query leaves from the Mutqan server at the Cloudflare edge. Geo-DNS, split-horizon (internal) DNS and your ISP's resolver can all give your own computer a different answer.

Only two public resolvers are offered here; the DNS Propagation Checker asks eight at once.

The answer is a resolver's cached view. It is not proof of what the authoritative servers hold now, and DNSSEC signatures are reported, not re-verified by the tool.

Security and privacy

The name you type and the record type are sent from the Mutqan server to the resolver you chose (Cloudflare or Google), which sees the query coming from Mutqan, not from you. Nothing is stored; analytics record only that the DNS endpoint was used.

References