Analyze your domain's overall security, DNSSEC, and DNS configuration with specialized tools.
This tool queries a domain's public DNS records and shows the value the resolver returns for the record type you select.
DNS Lookup Tool
Query DNS records for any domain and record type.
Frequently Asked Questions
It queries a domain's public DNS records and returns the value the resolver answers with, along with the data that comes with the response. It is useful to check what is published before or after a configuration change.
Ten record types can be queried: A, AAAA, MX, NS, PTR, TXT, CNAME, SOA, SRV and CAA. The three most useful for diagnosing email are MX, TXT and CNAME, because that is where SPF, DKIM and DMARC publications live.
A: one or more IPv4 addresses for the domain. AAAA: its IPv6 addresses. MX: the mail servers that receive the domain's messages, with their priority. TXT: arbitrary text; this is where SPF, DKIM, DMARC and ownership verifications are published. CNAME: an alias that points to another name and cannot coexist with other records of the same name. NS: the zone's authoritative DNS servers. SOA: zone data such as the primary server, the administrative contact and the refresh and expiry timers. SRV: the host and port where a given service is offered. PTR: reverse resolution, from an IP address to a name. CAA: which certificate authorities may issue certificates for the domain.
Yes. DNS records are public by design: any resolver can ask a zone's authoritative servers for them. That is why TXT records should not hold information that must stay private; the secrets of an email configuration (such as the DKIM private key) are never published.
Because SPF, DKIM, DMARC, BIMI, MTA-STS and DNSSEC are published as DNS records. This lookup shows the record in its raw form, exactly as a mail server sees it; a DMARC or DKIM checker, by contrast, interprets the record and tells you whether it is valid.
Either the domain does not publish that record type, the lookup did not resolve, or the resolver returned no answer at that moment. "There is no record" is not the same as "there is a mistyped one": if you expected to find it, check the exact name —including the subdomain and, for DKIM, the selector— and query again.
