Look up a domain's DNS records: A, AAAA, CNAME, MX, NS, TXT, CAA and SOA, with checks for the email records that stop spoofing (SPF, DMARC and DKIM) and common setup mistakes. Lookups go straight from your browser to Google's or Cloudflare's public DNS.
DNS is the internet's address book. When someone visits your site or sends you an email, their computer asks DNS where to go: which server hosts the website, which servers accept the mail, and which senders are allowed to send mail as your domain. This tool asks a public DNS resolver for all the common records of any domain at once, explains what each one does, and checks the records that most often go wrong: the email authentication records SPF, DMARC and DKIM, plus name servers, mail servers and certificate rules.
Tip: After changing a record, the old value can stay cached for as long as its TTL. Lower the TTL a day before a planned move, make the change, then raise it again.
Email was designed without any proof of who sent it, so anyone can write your domain in the From line. Three DNS records fix that. SPF is a TXT record starting v=spf1 that lists the servers allowed to send mail for your domain, ending in ~all or -all to say what should happen to mail from anywhere else. A domain must have exactly one SPF record, and checking it may take no more than 10 DNS lookups in total, counting nested includes; each email service you add usually costs one or more. The tool follows the includes and counts them for you.
DKIM adds a digital signature to each email, checked against a public key published at a selector name under _domainkey. DMARC, a TXT record at _dmarc, ties the two together: it tells receivers what to do with mail that fails (p=none to only watch, quarantine to send it to spam, reject to refuse it) and where to send reports. Gmail, Yahoo and Microsoft now require SPF, DKIM and DMARC from anyone sending in bulk, and without them even ordinary business email is more likely to land in spam.
Start with v=DMARC1; p=none; rua=mailto: an address you read. For two to four weeks, the reports show every service sending as your domain: your mailbox provider, newsletter tool, help desk, invoicing system. Add each legitimate one to SPF and set up DKIM for it. When the reports show only your own services, move to p=quarantine and then p=reject. Going straight to reject without that step can block your own invoices or password emails.
Each lookup asks Google Public DNS or Cloudflare 1.1.1.1 over an encrypted HTTPS connection from your browser, so the answers are what the public internet sees right now. Resolvers cache records for up to their TTL, so a change you just made may take minutes or hours to appear, and the two resolvers can briefly disagree. Large sites often return different addresses by location, so the A records you see may differ from a colleague's in another country.
When adding a service, merge its include into your existing record instead of adding a second one.
Remove includes for services you've stopped using; they quietly eat the budget.
Publish v=spf1 -all, a DMARC policy of reject and a null MX so nobody can spoof them.
1024-bit keys still work but are weaker; most providers let you rotate to 2048.
Naming your certificate authority stops anyone else issuing certificates for your domain.
Spread across networks, so one outage doesn't take the whole domain offline.
DKIM keys sit at a name only your provider knows, the selector. Enter it to check: common ones are google, selector1 and selector2 (Microsoft 365), and k1 (Mailchimp).
Resolvers keep old answers until the TTL runs out. Wait, or check that your name servers point to the provider where you made the change.
Type the subdomain itself, such as shop.example.com. DNS can't list every subdomain of a domain.
Both work. With DMARC at quarantine or reject, ~all is common and safe; -all is stricter at the SPF level.
Your browser sends the domain names to the resolver you choose, Google or Cloudflare, as any DNS lookup would. Nothing is sent to our servers.
No. That's registration data, separate from DNS.
Updated