Where the answers come from
The lookup is sent from this site's server to Cloudflare's public DNS-over-HTTPS resolver (the JSON API at cloudflare-dns.com), not to your domain's authoritative servers directly. That means you see what a major public resolver returns, including its cache, which is useful for checking what real visitors and mail servers are likely to see.
Record types in the drop-down
| Type | Holds | Where it matters |
|---|---|---|
| A / AAAA | IPv4 / IPv6 address | Pointing the site at a host |
| CNAME | Alias to another name | Hosting and CDN setups; cannot share a name with other records |
| MX | Mail servers with priority | Lowest number is tried first |
| TXT | Free-form text | SPF, DKIM, DMARC and domain verification |
| NS | Authoritative name servers | Confirming a DNS provider switch |
| SOA | Zone start of authority | Serial number and refresh timers |
| CAA | Certificate authorities allowed to issue certificates | Restricting who can issue TLS certificates |
The results table shows the name, type, TTL in seconds and the record data. A TTL of 300 means resolvers may keep that answer for five minutes before asking again.
The "All common types" option
Choosing it sends six queries at once, for A, AAAA, CNAME, MX, TXT and NS, in a single server call. Each type is shown in its own section in that fixed order. If one query fails or times out, the other five still display and the failed section reports its own error with a suggestion to look that type up on its own. The whole request only fails if all six fail. A type with no records shows "No records found", which is normal: most domains have no CNAME at the apex, and many have no AAAA.
Worked example
Looking up example.com as MX might return one answer such as 10 mail.example.com. with a TTL of 3600. The number before the host is the priority. Add a second record 20 backup.example.com. and mail goes to the 10 server first, falling back to 20 only if the first is unreachable.
Limits and gotchas
- NXDOMAIN banner. The red message appears when the resolver reports the name does not exist (status 3). It can also show for a sub-name that simply has no records.
- Underscore names work. Names may use letters, digits, hyphens and underscores in each label, up to 253 characters in total, so
_dmarc.example.com(look it up as TXT) and DKIM selectors such asgoogle._domainkey.example.comcan be looked up directly. - Paste a URL if you like. The scheme and path are stripped to the hostname before the lookup.
- Cache lag. After a change, the resolver may keep serving the old answer until its TTL runs out.
To see who runs the domain and when it expires, use the WHOIS lookup; to check what the web server answers once DNS resolves, use the HTTP headers checker.