DNS Lookup
Look up A, AAAA, CNAME, MX, TXT, NS, SOA, SRV and CAA records, including underscore names like _dmarc
FAQ
Which record types are supported?
A, AAAA, CNAME, MX, TXT, NS, SOA, SRV and CAA, covering most day-to-day troubleshooting.
Why are underscore names like _dmarc supported?
_dmarc, _acme-challenge and selector._domainkey are normal lookup targets for mail authentication, certificate issuance and DKIM, so labels may start with an underscore here. They only carry TXT/CNAME style records and are not hostnames you can browse to.
Why do I still get the old value after changing DNS?
DNS is cached and needs time to propagate. Recursive resolvers keep serving the old value until the TTL expires, typically minutes to 48 hours.
Which resolver does it use?
Public DoH (DNS over HTTPS) servers with AliDNS preferred in China and automatic failover, so results can occasionally differ from your local ISP resolver.
About this tool
Resolves nine record types over public DoH (DNS over HTTPS): A, AAAA, CNAME, MX, TXT, NS, SOA, SRV and CAA, showing the values, TTL and authoritative servers plus how long the query took.
The privacy boundary matters: this is not a local resolver - the domain is sent to a public resolver. Attempts go in the order AliDNS, DNSPod, Cloudflare, so your queries pass through those providers (DoH encrypts transport, but it does not make the lookup anonymous). For a fully local lookup use dig, nslookup or your own DoH endpoint.
Why failover instead of a single server: when one DoH endpoint misbehaves or gets hijacked, another often returns the right answer immediately. Each attempt times out after 6 seconds, and non-zero statuses such as SERVFAIL or REFUSED also move on to the next provider - this is not blind retrying, because different resolvers hold different caches, and cross-checking separates "the record really is absent" from "this resolver could not fetch it".
"I changed DNS and still get the old value" is the most common question: DNS is TTL-cached, and recursive resolvers keep serving the old record until the TTL expires - typically minutes to 48 hours. The TTL shown is the remaining cache lifetime, not a countdown to propagation. To confirm the change, query the authoritative server directly (dig @ns1.example.com) or compare against a freshly registered domain.
Underscore labels work: _dmarc.example.com, _acme-challenge.example.com, selector._domainkey.example.com. Mail authentication, certificate issuance and DKIM verification all require them, yet many online tools reject the names because their validation is too strict. They only carry TXT/CNAME records and are not browsable hostnames.
Two reading notes: NXDOMAIN means the domain itself does not exist, not that the record type is missing; "query succeeded but no records" means the domain exists without that type, usually a record you still need to add. CAA records decide which CAs may issue certificates for the domain, worth a quick check during HTTPS troubleshooting.