DNS lookup: see every record a domain publishes

This tool queries Cloudflare’s public DNS-over-HTTPS (DoH) resolver (cloudflare-dns.com, RFC 8484) on your behalf through an AdminKit Pages Function, rather than calling DNS servers directly from your browser. The function validates the domain name and record type before forwarding the query, times the upstream lookup out after 3 seconds, and caches each distinct name + type pair for 60 seconds. The function uses the JSON form of that resolver’s DoH API, which Cloudflare documents in its DNS over HTTPS request guide.

Supported record types

A and AAAA resolve a name to an IPv4 or IPv6 address, and NS lists the authoritative name servers for a zone, as defined in RFC 1035. CNAME is an alias to another name. MX, TXT, CAA, PTR and SOA are explained on their own tool pages or inline next to each result. Every record type’s name and numeric code is assigned in IANA’s Resource Record (RR) TYPEs registry. If a lookup here shows no CAA record, AdminKit’s CAA record generator builds one restricting which certificate authorities may issue for the domain. If the TXT record you are checking is an SPF, DKIM or DMARC policy, see SPF, DKIM and DMARC explained for what each one does and how to read it.

How to read the results

• Name — the name the answer belongs to, without the trailing dot. If the name you typed is an alias, the first row can be a CNAME for your name, followed by rows for the name it points to.
• Type — the record type of that row (A, AAAA, MX, TXT, NS, CAA, SOA, CNAME or PTR). The short line under the type picker says what the selected type controls.
• TTL — how many seconds a resolver may cache this answer before asking again. Cloudflare’s resolver reports the time left in its own cache, so the number can be lower than the TTL set in the zone.
• Data — the record’s value as the resolver returns it: an address for A/AAAA, priority host for MX, the quoted text for TXT, flags tag "value" for CAA, and the primary server, admin mailbox, serial and timers for SOA.
• “No records of this type were found for this name.” — the lookup worked but returned nothing of that type (see the FAQ below). Any other message (invalid name, rate limit, upstream timeout) means the lookup itself did not run.

Examples

Lookup	Typical answer	What it means
example.com A	example.com A 300s 192.0.2.10	The name points to one IPv4 address, cached for up to 300 seconds.
example.com MX	10 mail.example.com. and 20 mail2.example.net.	Mail goes to the priority-10 host first; the priority-20 host is a fallback.
example.org TXT	"v=spf1 ip4:198.51.100.0/24 -all"	An SPF record: only that range may send mail as example.org.
example.net AAAA	No records of this type were found	The name has no IPv6 address (or the name does not exist).
example.com CAA	0 issue "letsencrypt.org"	Only that certificate authority may issue certificates for the domain.

The answers above use documentation addresses (RFC 5737, RFC 3849) and reserved example domains to show the format; a live lookup returns whatever the domain really publishes.

Limits

• Only the record types listed above resolve; anything else is rejected before it reaches the upstream resolver, including newer types such as SVCB/HTTPS records, which this tool doesn’t support yet — see how to read an SVCB/HTTPS DNS record for what one looks like and how to check it manually today.
• Results reflect what Cloudflare’s resolver sees at query time — different resolvers can briefly disagree during DNS propagation after a change. To compare against a second resolver, Google Public DNS documents its own JSON API for DNS over HTTPS, which takes the same name and type query parameters.
• No query is logged; see /legal/privacy/ for what this tool processes.
• A lookalike domain can resolve perfectly cleanly here — valid records don’t mean the domain is the one you think it is, so if a name looks slightly off, check its characters with AdminKit’s IDN homograph check before trusting it.

If a change doesn’t seem to have taken effect yet, see DNS propagation and TTL explained for what controls the delay. See how to read a DNS lookup result for what each record type in the output means. See how this tool compares to Dig Web Interface if you need a wider set of record types or a specific nameserver instead. Reference: DNS, NS record, CAA record.

See best free DNS lookup tools for how this tool’s nine-record-type, single-resolver approach compares to MXToolbox, Google’s Admin Toolbox Dig, nslookup.io and intoDNS.