DNS lookup

A DNS lookup asks the Domain Name System what is published for a name. An A record gives the IPv4 address a website runs on, MX records name the servers that receive its email, and TXT records hold text such as SPF policies and site verification codes. This tool asks a public resolver for each record type and shows what comes back, with the TTL of each answer.

It answers the same questions. nslookup and dig are command-line programs that ask a DNS server for a record. This page does the same from your browser, for every common record type at once, and also names the DNS host, the email provider and the web host.

Open the Propagation check tab, enter the domain and pick the record type you changed. The tool asks Cloudflare, Google, AliDNS and DNS.SB at the same time and shows whether they agree. A resolver that still shows the old value will switch when the TTL shown next to its answer runs out.

TTL, or time to live, is how long a resolver may keep a record before asking again. A TTL of 1 hour means a change can take up to an hour to reach everyone who looked the record up recently. Lowering the TTL a day before a planned change makes the switch faster.

Most changes reach every resolver within the TTL of the record they replace, often minutes to a few hours. Changing the nameservers for a domain at the registrar can take longer, because the top-level domain servers cache that delegation too. Up to 48 hours is the figure registrars usually quote.

Run a lookup with All common types. The tool reads the nameservers, mail servers and aliases and names the DNS host, the email provider and, where it can tell, the web host. Names ending in google.com point to Google Workspace, names ending in outlook.com point to Microsoft 365.

A reverse lookup turns an IP address back into a host name using a PTR record. Mail servers use it to check senders: an IP that sends email should have a PTR name, and that name should point back to the same IP. The Reverse lookup tab checks both.

No. DNS has no command that lists every name in a zone. The Subdomain finder checks 46 names that sites commonly use, such as www, mail, api, app and shop, and shows which exist and where they point.

It means the resolver checked the cryptographic signatures on the answer back to the root of DNS and they were valid, so the answer was not forged on the way. Not signed is common and is not an error: most domains do not use DNSSEC yet. You turn it on at your DNS host, then add the DS record it gives you at your registrar.

Your browser sends each question straight to the public resolver over an encrypted HTTPS connection. The lookup does not pass through Dude Lemon’s servers and we do not store the domains you check. Recent lookups are kept only in your own browser.