DNS lookup

Look up any DNS name and record type the way dns.google does, through a public DNSSEC-validating resolver. Choose ANY to see the common types at once: because modern resolvers refuse real ANY queries, we ask for each type separately and merge the answers. Type an IP address to get its reverse (PTR) name.

Reading the result

• Status is the resolver's response code. NOERROR with an empty answer means the name exists but has no record of that type; NXDOMAIN means the name does not exist at all.
• DNSSEC validated means the resolver checked the signatures on the answer (the AD flag). Unsigned zones are not wrong, just unprotected against spoofing.
• TTL is how many seconds caches may keep the record. Lower it before a planned change, raise it afterwards.
• Meaning spells out structured records: MX priority and mail server, SOA timers, SRV ports, CAA rules, TLSA usage, DS and DNSKEY algorithms.

Records worth checking

CAA records say which certificate authorities may issue for your domain; a missing CAA lets any CA issue. TXT holds SPF, DKIM and DMARC for mail, plus domain-verification tokens that pile up over the years. HTTPS and SVCB records advertise HTTP/3 and ECH to new browsers. TLSA records (DANE) pin certificates for mail servers. The SOA serial tells you whether a change has propagated to the authoritative servers yet.

Why answers differ between resolvers

Caches, geographic (GeoDNS) answers and DNSSEC validation differences mean two resolvers can answer differently for a while after a change. This tool asks Cloudflare's resolver and falls back to Google's; the one that answered is named in the result.