DNS Lookup - A, AAAA, MX, NS, TXT, SOA, CAA, and Reverse

DNS is the system that turns a name people can remember into the addresses and configuration a machine needs. A single domain is not one record but a small collection of them, each answering a different question: which server hosts the site (A and AAAA), where its email goes (MX), which name servers are in charge (NS), and a pile of text-based settings for email security and verification (TXT). This tool asks for all of them at once and groups the answers by type, so you can see a domain's whole public configuration on one screen.

One thing worth being precise about is where these answers come from. When you look up a domain here, the request goes to our server's recursive resolver — the same kind of resolver your ISP or a public service like 1.1.1.1 runs. That resolver returns whatever it currently has cached, refetching from the domain's authoritative name servers only when its cache expires. So these results are the view the internet at large is getting, which is usually exactly what you want. What they are not is a direct, uncached query to your authoritative name server — if you have just changed a record and need to confirm the source of truth, query the name server itself with a tool like dig.

That caching is also why the TTL matters. The number shown next to each A and AAAA record is the seconds remaining before the resolver will refetch it. It counts down between lookups and resets when the resolver refreshes — so a value that keeps changing is not a glitch, it is the cache doing its job. This is the mechanism behind DNS propagation delay: after you edit a record, the old value keeps being served until every resolver's cached copy times out.

A missing record type is almost never an error — it just means the domain administrator never configured one. Plenty of domains have no AAAA record because they are IPv4-only, no CAA because the owner never set certificate restrictions, and no MX because they do not receive email. The absence is information, not a failure, so the tool simply omits types that return nothing rather than showing empty sections. Likewise, if a whole lookup comes back empty, the likeliest causes are that the domain does not exist or the resolver has no cached data for it yet.

What a lookup cannot do is prove that a record is correct. It shows you the SPF string, but not whether that string authorises the servers you actually send from; it shows the A record, but not whether the server behind it is up. It also cannot see records that are not published in public DNS — internal split-horizon zones, for example, are invisible from the outside by design, which is why the tool refuses to query private and internal addresses in the first place. Treat the output as an accurate reading of the public DNS, and pair it with the SSL checker for certificates or the ping and port tools for reachability when you need the fuller picture.