DNS Records Checker
Query common DNS record types through Cloudflare DNS-over-HTTPS and distinguish empty answers from resolver failures.
The exact DNS name matters. example.com, www.example.com, and _dmarc.example.com are different names and can legitimately return different records.
Resolver Results
DNS answers, negative responses, TTLs, and authority data will appear here.
What leaves your browser
Browser JavaScript cannot inspect DNS locally. Each lookup sends the normalized DNS name and requested record type to Cloudflare's public DNS-over-HTTPS resolver. The response can reflect recursive-resolver caching and may differ from another resolver or a direct query to an authoritative nameserver. Site-wide analytics or advertising scripts, if enabled, are separate from the DNS request.
NOERROR With No Answer Is Not the Same Thing as “This Domain Does Not Exist”
DNS answers have a response code and one or more sections. A resolver can return NOERROR while leaving the answer section empty. That often means the queried name exists but does not have the record type you asked for. For example, a host might have an A record but no AAAA record.
NXDOMAIN is different: it says the queried DNS name itself does not exist according to that resolver. Keeping these cases separate prevents a common troubleshooting mistake where “no MX records” gets reported as “the domain is broken.”
Authority records make negative answers more informative
Negative DNS responses can include SOA information in the authority section. That data helps resolvers cache the negative result and can show which zone is authoritative for the answer. Authority records remain visible instead of being discarded when the requested answer type is absent.
The Record Type Tells You What Question DNS Is Answering
A / AAAA
Address records map a name to IPv4 or IPv6 addresses. Having one does not imply the other exists.
CNAME
An alias points one DNS name at another name. The resolver can also return records reached through the alias chain.
MX
Mail exchanger records include a preference number. Lower numbers are normally preferred. A null MX target of . explicitly says the domain does not accept mail.
TXT
Generic text records carry SPF policy, verification values and other application data. DKIM usually lives at a selector-specific name, not automatically at the domain apex.
NS / SOA
NS records identify authoritative nameservers; SOA carries zone authority and timing metadata such as serial, refresh and retry values.
CAA
CAA can restrict certificate issuance, but an exact CAA query here does not reproduce a certificate authority's parent-label lookup procedure.
TTL Is a Cache Lifetime, Not a Propagation Countdown
The TTL shown with an answer tells a recursive resolver how long that record can be cached. After a DNS change, different resolvers can hold older cached answers for different amounts of time depending on when they queried the previous record.
That is why “DNS propagation” rarely behaves like one global timer that finishes everywhere at the same second. A cached resolver view, an authoritative-server view and your operating system's local cache can all disagree temporarily.
CNAME Answers Can Make an Address Query Look More Complicated Than Expected
If www.example.com is a CNAME, asking a recursive resolver for its A record can produce both the CNAME and address records for the final target. That is normal resolver behavior, but it means the answer section is not always made exclusively of the record type typed into the selector.
When debugging ownership or delegation rather than normal client resolution, query the exact CNAME, NS, or SOA type directly and, if necessary, compare the result with an authoritative nameserver.
DNSSEC: the AD Flag Is Helpful but Narrow Evidence
DNSSEC allows a validating recursive resolver to cryptographically verify signed DNS data. In a DNS response, the AD flag indicates that the resolver considers the relevant data authenticated.
An AD flag is not a complete DNSSEC audit. This page does not walk the chain of trust, inspect DS/DNSKEY records, compare validating resolvers, or diagnose why a SERVFAIL occurred. Treat AD as one resolver-provided signal, not as a security badge for the entire domain.
A Public Recursive Resolver Is Not the Same View as the Authoritative Server
Queries go to Cloudflare's recursive resolver, which answers the real question “what would a recursive client currently see?” That view is not the same as asking an authoritative nameserver directly.
If you just changed an MX record and the authoritative server shows the new value while the recursive result here shows the old one, caching may be the explanation. If the authoritative server itself has the wrong value, waiting for caches will not fix the configuration.