NETWORKS / PUBLIC DNS LOOKUP
DNS Toolbox
Look up DNS records and resolver-reported DNSSEC status, or compare two independent public resolver snapshots.
Choose a query
No lookup has been run.
DNS response
Your records will appear here.
Choose a name and record type, then run a lookup.- Query name
- Type / RCODE
- DNSSEC
- Resolver / time
Answer records
Authority records
Resolver comparison
- Observed TTL differences
- Resolver authentication differs
TTLs come from separate cache snapshots and are excluded from record-set matching. Matching empty/error responses do not certify correct DNS. DNSSEC authentication is reported by each resolver; this service does not validate the chain locally.
View record differences
Understand your DNS response
TTL is the lifetime in seconds reported in this resolver response. Separate caches can report different TTLs for the same records. TTL differences alone do not show failed propagation. Answers can also vary by cache age and geographic policy. A missing record is different from a domain that does not exist.
“Authenticated by resolver” reports the selected resolver’s AD flag. “Not authenticated” alone does not mean a domain is broken or insecure. A SERVFAIL response can have several causes; this tool does not label every failure as a DNSSEC error or verify the chain locally.
DNSKEY and DS let you inspect DNSSEC key and delegation records. TXT supports names such as _dmarc.example.com and selector._domainkey.example.com. DNS records are displayed as text; no connection is made to the addresses they contain. A two-provider comparison is a pair of snapshots, not a worldwide propagation or parent-delegation audit. NS responses in record/comparison mode show recursive resolver views, not a direct test of every authoritative server.
Advanced delegation mode discovers the parent zone through fixed HTTPS metadata, then directly samples one parent NS and one child NS over TCP port 53 with recursion disabled. It displays parent glue and DS observations and compares only validated authoritative child NS records. Other servers and addresses are not tested. Glue is never used to dial; names are independently resolved and revalidated. Private and this service’s own addresses are blocked. Timeouts and blocked targets stay inconclusive; no DNSSEC chain is validated. Each run costs four API quota units and has a five-second server deadline.