DNS Lookup
The query is sent directly from your browser to the resolver you pick above (Cloudflare or Google) over encrypted DNS-over-HTTPS — nothing passes through this site.
The query is sent directly from your browser to the resolver you pick above (Cloudflare or Google) over encrypted DNS-over-HTTPS — nothing passes through this site.
Type the domain name — a bare hostname like example.com, or paste a URL and it is cleaned up automatically.
Pick a record type, or leave "All common" to query A, AAAA, CNAME, MX, TXT and NS in one go.
Choose the resolver: Cloudflare (1.1.1.1) or Google (8.8.8.8) — comparing both is a quick propagation check.
Read the results: each record shows its name, TTL in seconds, type and value, plus a DNSSEC validation chip.
For troubleshooting, the status line explains NXDOMAIN, SERVFAIL and friends instead of leaving you a bare code.
Checking DNS usually means remembering dig syntax or trusting a random lookup site with your query. This tool does it from your own browser tab: pick a record type — or query all the common ones at once — and the records come back with their TTLs, ready to read. An SPF dispute, a dangling CNAME, a missing CAA record before a certificate issuance, or "has the new MX propagated yet" are all one lookup away.
Queries travel over DNS-over-HTTPS directly to the resolver you choose — Cloudflare (1.1.1.1) or Google (8.8.8.8) — encrypted end to end. Because these are validating resolvers, you also get DNSSEC status with every answer, and proper error explanations when something is wrong: NXDOMAIN for a name that does not exist, and SERVFAIL, which very often means the zone’s DNSSEC signatures are broken.
100% private“The domain you type is sent directly from your browser to the resolver you select (Cloudflare or Google) over encrypted DNS-over-HTTPS — that resolver necessarily sees the queried name, exactly as it would if your computer used it for normal DNS. Nothing touches this site’s infrastructure, because there is none.”
Caching. Each resolver serves records from its own cache until the TTL expires, so right after a DNS change one may have the new value while the other still holds the old one. Querying both here is a handy way to watch propagation happen.
The resolver could not get a validated answer from the domain’s authoritative servers. With validating resolvers like 1.1.1.1 and 8.8.8.8, the most common real-world cause is broken DNSSEC — expired or mismatched signatures — followed by all authoritative servers being unreachable.
No — the query goes to a public resolver, which only knows public DNS. Names that live on your corporate or home network (resolved by an internal DNS server) will come back NXDOMAIN here, and you probably don’t want to send them to a public resolver anyway.
PTR lookups work — select the PTR type and enter the reverse name yourself (for 203.0.113.9 that is 9.113.0.203.in-addr.arpa). A dedicated reverse-lookup mode that builds that name from a plain IP is a sensible future addition.