What this tool does
It queries public DNS resolvers directly from your browser over DNS-over-HTTPS and shows you exactly what came back — records, TTLs, response status and whether the answer was DNSSEC-validated. Nothing is logged on our end, because the query never touches our servers.
Picking a different resolver matters more than people expect. Cloudflare and Google run separate caches, so if you have just changed a record, one may still be serving the old value while the other has the new one. Comparing the two is the fastest way to tell whether a change has actually gone out.
The record types, in plain language
- A — the IPv4 address a name points to. The one people mean by “where does this site live.”
- AAAA — the same thing for IPv6.
- CNAME — an alias pointing one name at another. Cannot coexist with other records at the same name, which is the cause of a surprising number of outages.
- MX — where mail for this domain gets delivered. Lower priority number wins.
- TXT — free-form text. In practice this is where SPF, DMARC, DKIM and domain-ownership verification live.
- NS — the authoritative nameservers for the zone. If these are wrong, nothing else matters.
- SOA — zone metadata, including the serial number that tells you whether a change has been published.
- CAA — which certificate authorities are permitted to issue certificates for this domain. Worth setting; almost nobody does.
- SRV — service location records, used heavily by Microsoft 365, SIP and Active Directory.
- DS and DNSKEY — the DNSSEC chain of trust.
“DNS propagation” is not really a thing
There is no queue of servers slowly learning about your change. What actually happens is that every resolver that already looked up your record holds the old answer until its TTL expires. If the TTL was 3600, someone who queried a minute before your change will keep the old value for another 59 minutes — and nothing you do will shorten that.
The practical consequence: lower the TTL before you make a change, not after. Drop it to 300 a day ahead, make the change, then put it back. Doing that one thing removes most migration pain.
Reading the status line
- NOERROR with records — the normal case.
- NOERROR with no records — the domain exists but has nothing of that type. Common and usually not a problem.
- NXDOMAIN — the name does not exist. Check spelling, then check whether the domain is registered and the NS records are right.
- SERVFAIL — the resolver could not get a valid answer. Often a broken DNSSEC chain or unreachable authoritative servers.
- REFUSED — the server declined. Usually means you are asking a nameserver that is not authoritative for the zone.
Related tools
Working out an address plan rather than chasing a record? The subnet calculator handles CIDR, masks and VLSM splitting. More utilities are listed on the free tools page.