# DNS lookup > Look up any domain's DNS records (A, AAAA, CNAME, MX, NS, TXT, CAA, SOA) and check SPF, DMARC and DKIM email records with plain-English fixes. Free. Canonical: https://cromagnon.app/tools/dns-lookup Last updated: 2026-10-27 - Category: SEO - Formats: Domain - Use it: https://cromagnon.app/tools/dns-lookup (free, runs in the browser) ## What it does DNS is the internet's address book. When someone visits your site or sends you an email, their computer asks DNS where to go: which server hosts the website, which servers accept the mail, and which senders are allowed to send mail as your domain. This tool asks a public DNS resolver for all the common records of any domain at once, explains what each one does, and checks the records that most often go wrong: the email authentication records SPF, DMARC and DKIM, plus name servers, mail servers and certificate rules. ## How to use it 1. Type a domain, such as example.com. You can also paste a full web address or an email address; the domain is taken from it. 2. Optionally enter a DKIM selector to check a DKIM key too. Your email provider tells you its selector, or you can find it in the headers of an email you sent. 3. Choose Google or Cloudflare as the resolver. Both give the same public answers; switching is useful if one is blocked on your network. 4. Click Look up and read the summary first: setup checks, then SPF, DMARC and DKIM, each with what to fix. 5. Scroll down for every record by type, with its name, time to live and value. 6. Use Copy as zone file to share the records with your developer, host or email provider. Tip: After changing a record, the old value can stay cached for as long as its TTL. Lower the TTL a day before a planned move, make the change, then raise it again. ## The record types - **A and AAAA**: Point a name to a server's IPv4 and IPv6 addresses. These decide which server your website loads from. - **CNAME**: Makes one name an alias of another, such as www pointing to your host's address. A name with a CNAME can't have other records, which is why the bare domain usually uses A records or a provider's flattening feature instead. - **MX**: Lists the servers that receive email for the domain, each with a priority number; lower numbers are tried first. A null MX (0 .) says the domain accepts no mail. - **NS**: Names the servers that hold the domain's records. Changes at your DNS provider only take effect if these point to it. - **TXT**: Free text, used for SPF, domain verification codes for Google, Microsoft and others, and many more purposes. - **CAA**: Lists the certificate authorities allowed to issue certificates for the domain, such as letsencrypt.org. - **SOA**: The start of authority: the primary name server, the administrator contact and a serial number that changes with each update. ## SPF, DMARC and DKIM: why email lands in spam Email was designed without any proof of who sent it, so anyone can write your domain in the From line. Three DNS records fix that. SPF is a TXT record starting v=spf1 that lists the servers allowed to send mail for your domain, ending in ~all or -all to say what should happen to mail from anywhere else. A domain must have exactly one SPF record, and checking it may take no more than 10 DNS lookups in total, counting nested includes; each email service you add usually costs one or more. The tool follows the includes and counts them for you. DKIM adds a digital signature to each email, checked against a public key published at a selector name under _domainkey. DMARC, a TXT record at _dmarc, ties the two together: it tells receivers what to do with mail that fails (p=none to only watch, quarantine to send it to spam, reject to refuse it) and where to send reports. Gmail, Yahoo and Microsoft now require SPF, DKIM and DMARC from anyone sending in bulk, and without them even ordinary business email is more likely to land in spam. ## A safe path to DMARC enforcement Start with v=DMARC1; p=none; rua=mailto: an address you read. For two to four weeks, the reports show every service sending as your domain: your mailbox provider, newsletter tool, help desk, invoicing system. Add each legitimate one to SPF and set up DKIM for it. When the reports show only your own services, move to p=quarantine and then p=reject. Going straight to reject without that step can block your own invoices or password emails. ## Why lookups are live and may differ Each lookup asks Google Public DNS or Cloudflare 1.1.1.1 over an encrypted HTTPS connection from your browser, so the answers are what the public internet sees right now. Resolvers cache records for up to their TTL, so a change you just made may take minutes or hours to appear, and the two resolvers can briefly disagree. Large sites often return different addresses by location, so the A records you see may differ from a colleague's in another country. ## Tips - **One SPF record only**: When adding a service, merge its include into your existing record instead of adding a second one. - **Mind the 10-lookup limit**: Remove includes for services you've stopped using; they quietly eat the budget. - **Domains that send no mail**: Publish v=spf1 -all, a DMARC policy of reject and a null MX so nobody can spoof them. - **Use 2048-bit DKIM keys**: 1024-bit keys still work but are weaker; most providers let you rotate to 2048. - **Add a CAA record**: Naming your certificate authority stops anyone else issuing certificates for your domain. - **Two or more name servers**: Spread across networks, so one outage doesn't take the whole domain offline. ## Questions ### Why can't I see my DKIM record? DKIM keys sit at a name only your provider knows, the selector. Enter it to check: common ones are google, selector1 and selector2 (Microsoft 365), and k1 (Mailchimp). ### Why don't my new records show yet? Resolvers keep old answers until the TTL runs out. Wait, or check that your name servers point to the provider where you made the change. ### Does the tool show subdomains? Type the subdomain itself, such as shop.example.com. DNS can't list every subdomain of a domain. ### Is ~all or -all better? Both work. With DMARC at quarantine or reject, ~all is common and safe; -all is stricter at the SPF level. ### Who sees my lookups? Your browser sends the domain names to the resolver you choose, Google or Cloudflare, as any DNS lookup would. Nothing is sent to our servers. ### Can it check a domain's WHOIS or expiry date? No. That's registration data, separate from DNS. ## Related - [HTTP Header Checker](https://cromagnon.app/tools/http-header-checker) - [Broken Link Checker](https://cromagnon.app/tools/broken-link-checker) - [On-Page SEO Checker](https://cromagnon.app/tools/on-page-seo-checker) - [Redirect Generator](https://cromagnon.app/tools/redirect-generator) - [All tools](https://cromagnon.app/tools)