search⌘KtranslateENexpand_moreupload_fileConvert

home/network-tools/dns-lookup

DNS lookup

See every record a domain publishes, where it points, who handles its mail, and what it says about itself.

languagesearchLook up

Cloudflare1.1.1.1Google8.8.8.8Quad99.9.9.9

Try:fileformer.comgithub.comwikipedia.org

ALL10A2AAAA2CNAME0MX1TXT2NS2SOA1CAA0

example.com · 10 records · 126 ms

typevaluettl

A172.66.147.243IPv4 address18 scontent_copy

A104.20.23.154IPv4 address18 scontent_copy

AAAA2606:4700:10::6814:179aIPv6 address1 min 20 scontent_copy

AAAA2606:4700:10::ac42:93f3IPv6 address1 min 20 scontent_copy

MX0 .mail server3 min 30 scontent_copy

TXT"v=spf1 -all"text record4 min 10 scontent_copy

TXT"_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"text record4 min 10 scontent_copy

NShera.ns.cloudflare.com.name server21 h 45 mincontent_copy

NSelliott.ns.cloudflare.com.name server21 h 45 mincontent_copy

SOAelliott.ns.cloudflare.com. dns.cloudflare.com. 2416374680 10000 2400 604800 1800zone authority30 mincontent_copy

Live answers from Cloudflare 1.1.1.1 over DNS over HTTPS. Only the domain name and record type are sent.

~/what-each-record-means

Eight records, explained.

Think of DNS as a domain's public address book. Each record type answers one question the internet asks about it. Pick one to see what it does, what it looks like and where people go wrong.

AIPv4 addressWhere is this website?chevron_rightAAAAIPv6 addressWhere is it on the newer internet?chevron_rightCNAMEAliasIs this name really another name?chevron_rightMXMail serverWhere should email go?chevron_rightTXTTextWhat else should others know?chevron_rightNSName serverWho holds the official answers?chevron_rightSOAStart of authorityWho is in charge, and how fresh is it?chevron_rightCAACertificate authorityWho may issue SSL certificates?chevron_right

IPv4 addressAnswers: “Where is this website?”

Maps the domain to the IPv4 address of the server that hosts it. When you type the domain, your browser asks for this record and then connects to that number.

lightbulbIn everyday termsLike the street address on a contacts card: the name is for people, the number is how the delivery actually finds the building.

What it looks like

example.com.3600INA93.184.216.34

Visitors to example.com connect to server 93.184.216.34; resolvers may cache this for 3600 seconds (1 hour).

editWhen you'd change itMoving to a new host or server, or pointing the domain at a new load balancer.

warningCommon mistakeChanging hosts without lowering the TTL first: old visitors keep hitting the old server for hours.

arrow_backCAA1 / 8AAAAarrow_forward

~/the-journey-of-a-lookup

What happens in the 20 ms after you press Enter.

Before a page can load, your device has to turn the name into an address. It asks a chain of servers, each one pointing to the next. Step through it.

devicesYour device0 msdnsResolver2 mspublicRoot server6 mslanTLD server10 msverifiedAuthoritative server16 mscheck_circleAnswer delivered18 ms

step 1 of 6 · Your deviceYour browser and operating system check their own cache first. If you visited example.com recently, the answer is already here and nothing else happens.

? example.com (local cache)× not cached: ask the resolver

arrow_backBackelapsed 0 msNextarrow_forward

~/why-changes-take-time

“Propagation” is really just caching.

When you change a record, resolvers around the world keep serving their saved copy until its TTL runs out. Set a TTL to see how long the old answer could linger.

1 min5 min1 h4 h1 day

right away0 s

after ¼ TTL15 min

after ½ TTL30 min

after ¾ TTL45 min

after full TTL1 h

still old addressnew address

Worst case: 1 h of mixed answers

One hour is a common default: changes settle within the hour and resolvers don’t have to ask very often.

moving servers? do this01Lower the TTL to 5 minutes a day before the move.02Change the A record once the new server is ready.03Raise the TTL back to an hour or more once traffic has moved.

~/when-it-doesnt-work

Symptom → the record to check.

languageSite doesn’t load at allAThe A record is missing, points to an old server, or the domain has expired.buildLook up the A record and compare it with the IP your host gives you.

mailEmail isn’t arrivingMXMX records point to an old provider, or there are none.buildCheck the MX records match your current email provider’s settings exactly.

reportEmails land in spamTXTSPF, DKIM or DMARC records are missing or wrong, so receivers can’t verify you.buildAdd your provider’s SPF include and DKIM key; start DMARC with p=none.

sync_problemWorks for me, not for othersTTLSome resolvers still have the old record cached.buildWait for the old TTL to expire, or compare results across the three resolvers above.

lockCertificate won’t issueCAAA CAA record allows a different certificate authority.buildAdd the new CA to your CAA records, or remove CAA to allow any.

subdirectory_arrow_right“www” works but the root doesn’tA / CNAMEOnly one of the two names has a record.buildAdd an A record on the root, and a CNAME from www to the root.

~/the-actual-bytes

Build a real DNS packet, send it, and read every byte of the answer.

DNS messages are a compact binary format from 1987: a 12-byte header, then questions and records. Names are written as length-prefixed labels, and repeated names are replaced with 2-byte pointers. Your browser builds the query below byte by byte, sends it to Cloudflare over HTTPS as RFC 8484 describes, and decodes the binary reply right here.

AAAAAMXTXTNSSOACAAHTTPS

sendSend query

QUERY · 29 bytesGET /dns-query?dns=…

000001000001000000000000076578616d706c6503636f6d0000010001

ID 00 00Zero, as RFC 8484 recommends, so HTTP caches can share answers.flags 01 00Only RD set: recursion desired, so the resolver does the whole lookup.counts1 question, 0 answers, 0 authority, 0 additional.labels7 · example, 3 · com, then 0 for the root.QTYPEA = 1 (00 01)QCLASS1 = IN, the internet class.

base64url: AAABAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE

RESPONSE · 61 bytes125 ms round trip

000081800001000200000000076578616d706c6503636f6d0000010001c00c00010001000000120004ac4293f3c00c000100010000001200046814179a

QRAATCRDRAADCDRCODE 0 NOERROR

Flags 81 80. AD is clear: this zone isn’t DNSSEC-signed, or the answer couldn’t be validated.

sectionnametypeTTLdataname encoding

answerexample.com.A18 s172.66.147.243pointer to byte 12

answerexample.com.A18 s104.20.23.154pointer to byte 12

■ header■ question■ record name■ compression pointer■ type, class, TTL, length■ record data

~/reference

Type codes, response codes and limits.

The numbers that actually travel in the packet, from the IANA DNS parameters registry, and the RFC that defines each one.

typecodedefined inwhat the data holds

A1RFC 1035A 32-bit IPv4 address, exactly 4 bytes.

NS2RFC 1035The name of an authoritative server for the zone.

CNAME5RFC 1035Another name to look up instead. Can’t sit at the zone apex or beside other records.

SOA6RFC 1035Primary server, admin mailbox, serial number and the zone’s timers; its last field sets how long “doesn’t exist” is cached.

PTR12RFC 1035A name for reverse lookups under in-addr.arpa and ip6.arpa.

MX15RFC 1035A 16-bit preference, lower first, then a mail server name.

TXT16RFC 1035One or more strings of up to 255 bytes each. SPF, DKIM and site verification live here.

AAAA28RFC 3596A 128-bit IPv6 address, 16 bytes.

SRV33RFC 2782Priority, weight, port and target for a named service.

OPT41RFC 6891Not a real record: EDNS(0) options and a larger UDP size, in the additional section.

DS43RFC 4034A hash of the child zone’s key, held by the parent. Links the DNSSEC chain.

DNSKEY48RFC 4034A zone’s public DNSSEC key.

HTTPS65RFC 9460Connection hints for HTTPS: ALPN protocols such as h3, IP hints and ECH keys.

CAA257RFC 8659Flags, a tag such as issue or iodef, and a value naming an allowed certificate authority.

Response codes (RCODE)

0NOERRORThe query succeeded. There may still be no records of the type asked for, which is called NODATA.

1FORMERRThe server couldn’t parse the query.

2SERVFAILThe server failed. Often a broken DNSSEC signature or an unreachable authoritative server.

3NXDOMAINThe name doesn’t exist at all.

4NOTIMPThe server doesn’t support this kind of query.

5REFUSEDThe server refuses to answer, such as a resolver that only serves its own network.

Limits in the format

63 bytesLongest single label, because the top two bits of the length byte mark pointers.

255 bytesLongest full name on the wire, including the length bytes.

512 bytesOriginal UDP message limit. Larger replies set TC and the client retries over TCP.

1,232 bytesThe EDNS buffer size agreed on DNS Flag Day 2020 to avoid IP fragmentation.

2³¹ − 1 sLargest TTL allowed (about 68 years); RFC 2181 says to treat larger values as 0.

65,535Most records of each section, from the 16-bit counts in the header.

From HOSTS.TXT to encrypted lookups

1983DNS is designedPaul Mockapetris publishes RFC 882 and 883, replacing the single HOSTS.TXT file.

1987RFC 1034 and 1035The definitions still in use today, including the wire format shown above.

1999EDNS(0)RFC 2671 adds the OPT record, larger UDP messages and room for extensions.

2005DNSSECRFC 4033-4035 describe signed zones; the root is signed in 2010.

2016DNS over TLSRFC 7858 encrypts DNS on port 853.

2018DNS over HTTPSRFC 8484, the protocol this lab uses. Cloudflare launches 1.1.1.1.

2020DNS Flag DayLarge resolvers agree on a 1,232-byte EDNS buffer size.

2023HTTPS recordsRFC 9460 standardises SVCB and HTTPS records, already queried by browsers.

Sources

[1]RFC 1035Message format, labels, compression pointers and the original record types.IETF ↗[2]RFC 8484: DNS over HTTPSThe GET ?dns= and POST forms used by the lab.IETF ↗[3]IANA DNS parametersThe registry of type codes and RCODEs.IANA ↗[4]RFC 6891: EDNS(0)The OPT pseudo-record and larger UDP messages.IETF ↗[5]RFC 9460: SVCB and HTTPSService binding records for HTTPS.IETF ↗[6]Cloudflare DoH JSON APIThe JSON format behind the lookup at the top.Cloudflare ↗

More network tools

DNS tells you where a domain points. These check what's actually there.

All tools →

lockSSL Checker

Check a site’s HTTPS certificate: issuer, expiry and supported protocols.

example.comarrow_forwardvalid · 62 days left

badgeWhois Lookup

See who registered a domain, when it expires and which registrar holds it.

example.comarrow_forwardexpires 2027-08-13

network_pingPing Test

Measure how quickly a server responds and whether packets are lost.

example.comarrow_forward14 ms · 0% loss

routeTraceroute

See every network hop between you and the server.

you → example.comarrow_forward11 hops

httpHTTP Header Viewer

Inspect the response headers a server sends back.

GET /arrow_forward200 OK · 14 headers

settings_ethernetPort Checker

Check whether a port (like 443 or 25) is open to the internet.

example.com:443arrow_forwardopen