Summary
A DNS lookup asks the Domain Name System which records a name has: the IP addresses a site runs on, the servers that receive its email, and the text records that prove ownership and guard against spoofing. To look up a domain free here, type it into Domain name or IP address, choose a Record type (or All common) and press Look up. Each type gets its own card with its records, their TTL, the response code and whether DNSSEC validated the answer. Enter an IP address and the tool runs a reverse (PTR) lookup instead.
This tool is not browser-only. When you press Look up, your browser sends the name and the record types to ZipConvertās server, which asks Cloudflareās public DNS resolver (cloudflare-dns.com, 1.1.1.1) and returns the answer. Nothing is sent while you type, and the names you look up are not stored.
Reverse names: 192.0.2.10 is queried as 10.2.0.192.in-addr.arpa, the four numbers in reverse order; an IPv6 address becomes its 32 hex digits, reversed and separated by dots, under ip6.arpa.
Table of Use: Which Record Answers Which Question
The example values are illustrative; the IP addresses come from the ranges reserved for documentation.
| Your question | Record type to choose | Example value |
|---|---|---|
| Which server does a website point to? | A (IPv4) or AAAA (IPv6) | 192.0.2.10 |
| Is a name an alias of another name? | CNAME, which cannot sit alongside other records of the same name | example.com. |
| Which servers receive the domainās email? | MX; the lowest number is tried first | 10 mail.example.com. |
| Who runs the domainās DNS? | NS | ns1.example.com. |
| Are SPF, DMARC or DKIM set up? | TXT, on the domain, _dmarc.domain or selector._domainkey.domain | "v=spf1 include:_spf.google.com ~all" |
| Which certificate authorities may issue certificates? | CAA | 0 issue "letsencrypt.org" |
| Where is a service such as SIP found? | SRV, on names like _sip._tls.example.com | 100 1 443 sip.example.com |
| What are the zoneās serial number and timers? | SOA | ns1.example.com. admin.example.com. 2026100601 7200 3600 1209600 300 |
| Which hostname does an IP address have? | Enter the IP address; a PTR lookup runs | dns.google. |
Features
- Ten record types: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV and PTR. All common asks for the first eight in one go.
- Forgiving input. Paste a domain, a URL, an email address, host:port or an IPv4 or IPv6 address; the tool keeps the domain or address and drops the rest. If you pick PTR for something that is not an IP address, it asks for one.
- Readable answers. Each record shows its TTL as, say, 5m (300 s). This is the time left in Cloudflareās cache, so it can be lower than the TTL set at your DNS host. The status is shown as NOERROR, NXDOMAIN, SERVFAIL and so on, an alias chain is spelled out (āa is an alias of bā), MX records are sorted lowest number first, and a line under each card says whether DNSSEC validated the answer.
- Copy what you need. Each record has a copy button, and Copy all results gives dig-style lines with the name, TTL, type and value.
- Try buttons for google.com (All common), gmail.com (MX), _dmarc.google.com (TXT) and 8.8.8.8 (PTR).
Limits: it queries one resolver, so it is not a worldwide propagation checker; it cannot ask a domainās own name servers directly, and it does not offer ANY, DNSKEY or DS queries. Internationalised names are converted to their ASCII (punycode) form before the query.
How to Use the DNS Lookup Tool
- Type a domain, URL, email address or IP address into Domain name or IP address, or press one of the buttons after Try.
- Under Record type, click All common or a single type such as MX or TXT.
- Press Look up (or Enter). The button reads Looking upā¦ until the answer arrives.
- Read each card: the status badge, the records with their TTL, and the DNSSEC line at the bottom.
- Copy one record with its copy button, or everything with Copy all results.
TTL is how long resolvers may cache an answer: 300 seconds (5 minutes) is common before a migration, 3,600 (1 hour) for everyday records and 86,400 (1 day) for records that rarely change. Lower a TTL a day before you move a site, then use the countdown timer to wait out the old TTL. To see what a change did, copy the results before and after and compare them with the text diff tool.
Who Can Use It
Site owners checking a new host or a migration, email administrators setting up MX, SPF, DKIM and DMARC, and developers debugging why a name does not resolve. Pair it with the WHOIS lookup to see who registered a domain, the SSL certificate checker after changing CAA records, and the HTTP header viewer once the name resolves.
The email validator checks the MX records behind an address, the IP address lookup shows the approximate location and ISP of an address you found, the common ports list explains which services should face the internet, and the .htaccess generator writes redirects once the domain points to the new server.
FAQs
How do I look up the DNS records of a domain?
Type the domain, such as example.com, into Domain name or IP address, choose a Record type or All common, and press Look up. You can also paste a full URL or an email address; the tool keeps only the domain. Each record type gets its own card with the records, their TTL, the response code and the DNSSEC status.
How do I do a reverse DNS (PTR) lookup?
Enter the IP address, for example 8.8.8.8 or 2001:4860:4860::8888, and press Look up. The tool turns it into the special reverse name (8.8.8.8.in-addr.arpa for IPv4, a nibble-by-nibble ip6.arpa name for IPv6) and asks for its PTR record, which for 8.8.8.8 is dns.google. An IP address always gets a PTR lookup, whatever type is selected.
How do I check SPF, DMARC or DKIM records?
Choose TXT. SPF lives on the domain itself (look for a record starting v=spf1). DMARC lives on _dmarc followed by the domain, for example _dmarc.example.com. DKIM lives on selector._domainkey followed by the domain, where the selector is named in the DKIM-Signature header of an email the domain sent.
What does NXDOMAIN mean?
NXDOMAIN means the name does not exist in DNS: it was mistyped, the domain is not registered, or the subdomain was never created. It is different from NOERROR with no records, which means the name exists but has no records of the type you asked for, for example a domain with an A record but no AAAA record.
Why do my results differ from what I just changed?
Resolvers cache answers for up to the recordās full TTL, so a change can take that long to appear everywhere. The TTL shown here is the time left in Cloudflareās cache, so it can be lower than the TTL set at your DNS host and falls on repeat lookups. This tool asks one resolver, so it is not a worldwide propagation checker: other resolvers and your own computer may still hold the old answer.
What does āDNSSEC validatedā mean?
It means the resolver checked the cryptographic signatures on the answer and they were valid, so the records were not tampered with on the way. āNot DNSSEC-validatedā usually means the zone is not signed at all; a zone with broken signatures returns SERVFAIL instead.
Is my DNS lookup private?
The tool is not browser-only. When you press Look up, your browser sends the name and record types to ZipConvertās server, which asks Cloudflareās public DNS resolver (1.1.1.1) and returns the answer. Nothing is sent while you type. The names you look up are not stored; only a per-IP request counter, used for the rate limit, is kept, and it expires after two minutes.
How many DNS lookups can I run?
Up to 30 lookups a minute from one IP address. All common counts as a single lookup even though it asks for eight record types. Past the limit the tool shows āToo many requests. Please wait a minute and try again.ā and works again after a minute. A record type that does not answer within 8 seconds is reported as a failed lookup for that type only.