Home > Resources > Tools > DNS Record Lookup


DNS Lookup

Inspect a domain's DNS records, mail authentication, DNSSEC chain, and blacklist reputation — queried in parallel over DNS-over-HTTPS against Google and Cloudflare.
More Information About the DNS Lookup

The DNS Lookup tool queries the public DNS for a domain over DNS-over-HTTPS, side-by-side against both Google (dns.google) and Cloudflare (cloudflare-dns.com) so you can spot propagation gaps or anycast variance.

It checks the records that matter for hosting, email deliverability, and security:

  • A · AAAA · CNAME · NS · SOA · PTR — the core resolution chain and reverse mapping.
  • MX · SPF · DKIM · DMARC · BIMI · MTA-STS · TLSRPT — full email-authentication picture, including DKIM selector discovery and TLS reporting.
  • CAA — which Certificate Authorities are authorised to issue certs for the domain.
  • DS · DNSKEY · RRSIG — the DNSSEC chain back to the parent zone, plus an AD flag check.
  • WHOIS (RDAP) — registrar, registration / expiry dates, status flags, and listed nameservers.
  • BLACKLIST — checks each resolved IP against Spamhaus, SpamCop, Barracuda, SORBS, and PSBL.

Results land in a health banner with prioritised insights (missing SPF, weak DMARC policy, expired CAA, mid-propagation, etc.) and you can export the full JSON for tickets or follow-up. Need to look at a certificate the domain serves? Try the Certificate Decoder or the SSL Checker.

Quick scan
⌕
Try:

Record Types

What do these mean?
A / AAAAIPv4 / IPv6 addresses the domain points to.
CNAMEAlias — points one hostname to another.
PTRReverse DNS — checks if the IP maps back to a hostname.
MX / NS / SOAMail exchangers · Name servers · Zone authority/serial.
TXTFree-form text records — verification, SPF, etc.
SPFLists IP ranges authorized to send mail for the domain.
DKIMPublic keys signing outbound mail. We check common selectors.
DMARCPolicy when SPF/DKIM fail — none / quarantine / reject.
BIMIBrand logo shown in supporting mail clients.
MTA-STSTells sending servers to require TLS to your MX.
TLSRPTWhere to report TLS handshake failures.
CAAWhich Certificate Authorities can issue certs for the domain.
BlacklistChecks your mail server IPs against major DNSBLs.
WHOISDomain registration — registrar, dates, status, NS, DNSSEC.
DS / DNSKEY / RRSIGDNSSEC chain — delegation signer, keys, signatures.

Enter a domain to begin.

← All Tools
Related Tools SSL Checker → Certificate Decoder → Revocation Checker →
SSL Resources
Next-Generation SSL (NGSSL)
Blogs about SSL Certificates
Other Resources
FREE PKI Health Check
Digital Signing 101 Workshop

Contact Us: General enquiries or free consultation

We’re really grateful for giving us a chance to connect with you. Please do not hesitate to ask us anything and we will respond to you asap.

image

    You have read, understood and agree to be bound by Netrust's Personal Data Protection Policy and Terms of Service.

    This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.