DNS Lookup
Query public DNS records through a disclosed DNS-over-HTTPS resolver.
Explicit network action
Choose what Cloudflare resolves
No request made
Nothing is resolved until you submit
Enter a public DNS name and choose a record type. Editing the fields never triggers a lookup.
Working notes
Use DNS Lookup with the boundary visible.
DNS Lookup asks Cloudflare's disclosed DNS-over-HTTPS resolver for one public record type after an explicit action, then keeps the bounded response in memory only.
What is DNS Lookup?
The Domain Name System (DNS) is the internet's address book. When you type a domain name like example.com into a browser, DNS translates it to an IP address (e.g., 93.184.216.34) so your device can connect to the right server. DNS stores many types of records beyond simple address lookups: MX records route email to the correct mail server, TXT records carry verification codes and security policies (SPF, DKIM, DMARC), CNAME records create aliases, and NS records delegate authority to nameservers. A DNS lookup tool lets you query these records directly, which is essential for diagnosing connectivity issues, verifying DNS propagation after changes, auditing email authentication setup, and confirming that DNSSEC is properly configured. This tool uses Cloudflare's public DNS-over-HTTPS (DoH) resolver at 1.1.1.1, which encrypts the query in transit and provides DNSSEC validation. The resolver is disclosed before the lookup, and the response stays in your browser memory only — nothing is logged or stored by StackCache.
When to use it
- Verifying DNS propagation — after changing nameservers, adding an A record, or updating MX records, check that the new values have propagated to public resolvers.
- Diagnosing email delivery problems — look up MX, SPF (TXT), DKIM, and DMARC records to identify misconfigured email authentication that causes messages to land in spam.
- Auditing domain security — check CAA records (which CAs can issue certificates), DNSKEY records (DNSSEC signing keys), and DS records (delegation signer) for a domain.
- Debugging CNAME chains — trace CNAME aliases to their final A or AAAA record to identify CDN or load balancer endpoints.
- Reverse DNS lookups — query PTR records for an IP address to find the hostname, which is useful for verifying mail server identity and investigating network traffic.
How to use it
- 01Enter a public hostname or domain. For PTR lookups, enter an IPv4/IPv6 address or reverse-DNS name.
- 02Choose the record type: A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, PTR, CAA, or DNSSEC types (DNSKEY, DS, RRSIG, NSEC, NSEC3PARAM).
- 03Review the provider disclosure (Cloudflare 1.1.1.1 via DoH) and run the lookup.
- 04Inspect the response: status code (NOERROR, NXDOMAIN, SERVFAIL), returned records with TTL values, and the DNSSEC AD (Authenticated Data) flag.
- 05Clear the result or navigate away — nothing is persisted.
Common mistakes
- Expecting instant propagation — DNS changes can take minutes to hours to propagate depending on TTL values. If you do not see the new record, wait for the old TTL to expire.
- Querying the wrong record type — email problems require MX and TXT lookups, not A records. Website issues need A or AAAA records, not CNAME.
- Confusing authoritative and recursive results — this tool queries a recursive resolver (Cloudflare), which may return cached answers. For authoritative answers, query the domain's nameservers directly.
- Ignoring TTL values — a low TTL means the record updates quickly but increases DNS query load. A high TTL means changes propagate slowly. Understanding TTL is essential when planning DNS changes.
- Misreading DNSSEC AD flag — the AD (Authenticated Data) flag indicates that the recursive resolver validated the DNSSEC signatures. It does not mean StackCache independently verified them.
Synthetic example
Synthetic A lookup
Input
example.com · A
Result
NOERROR · A · 192.0.2.20 · TTL 60s
Common DNS record types
| Feature | Record | Purpose | Example value |
|---|---|---|---|
| A | A | IPv4 address | 93.184.216.34 |
| AAAA | AAAA | IPv6 address | 2606:2800:220:1:248:1893:25c8:1946 |
| CNAME | CNAME | Alias to another name | www.example.com → example.com |
| MX | MX | Mail server | 10 mail.example.com |
| TXT | TXT | Text (SPF, DKIM, verification) | v=spf1 include:_spf.google.com ~all |
| NS | NS | Authoritative nameserver | ns1.example.com |
| SOA | SOA | Zone authority and serial | ns1.example.com admin.example.com 2024010101 |
| CAA | CAA | Certificate authority authorization | 0 issue "letsencrypt.org" |
Related standards
Limits and data boundary
- The query name and type leave the browser in an HTTPS GET URL and Cloudflare receives normal connection metadata.
- The JSON response format is provider-specific; DNSSEC AD reflects the resolver's validation and is not independently verified by StackCache.
- Private split-horizon, hosts-file, LAN, multicast DNS, and the device's configured resolver are not queried.
Frequently asked questions
- Which DNS record types can I look up?
- A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, PTR, CAA, CERT, LOC, IPSECKEY, and DNSSEC-related types including DNSKEY, DS, RRSIG, NSEC, and NSEC3PARAM.
- Which DNS resolver is used?
- Queries are sent to Cloudflare's public DNS-over-HTTPS resolver (1.1.1.1). The resolver is disclosed before the lookup and no proxy is involved.
- Does this tool query my local DNS server?
- No. The lookup uses Cloudflare's public resolver, not your device's configured DNS. Private DNS zones, hosts-file entries, and split-horizon names are not visible.
- Why does the lookup return NXDOMAIN?
- NXDOMAIN means the domain does not exist in DNS. This can indicate a typo, an unregistered domain, or a recently deleted DNS zone that has not expired from caches.
- What is DNS-over-HTTPS (DoH)?
- DoH encrypts DNS queries inside HTTPS requests, preventing network observers from seeing which domains you look up. It also authenticates the resolver, preventing DNS spoofing.
Keep working