DNS Record Lookup
Look up any DNS record type for its purpose, RFC, typical usage, and security notes. Runs entirely in your browser.
Calculator
Record
Example Record
Typical Usage
TTL Guidance
Common Mistakes
Security Notes
Related Records
| Record Type |
|---|
Record Type
—
How DNS Record Lookup Works
What is DNS?
DNS (the Domain Name System) is the phonebook of the internet — it translates human-readable
domain names like example.com into the numeric IP addresses computers actually use to
route traffic, and stores many other kinds of operational metadata about a domain besides. Every time
you visit a website, send email, or connect to an API by hostname, a DNS lookup happens first, usually
in milliseconds and entirely invisibly.
DNS Resolution
Resolving a name is a hierarchical process: your resolver asks a root server which server is
authoritative for .com, then asks that server which nameservers are authoritative for
example.com, then finally asks one of those nameservers for the actual record. Caching at
every layer (governed by each record's TTL) is what makes this fast in practice, despite the number of
hops involved.
Forward vs Reverse Lookup
A forward lookup answers "what IP address does this hostname point to?" — the job
of A and AAAA records. A reverse lookup answers the opposite question, "what hostname
does this IP address belong to?" — the job of the PTR record, stored under the special
in-addr.arpa (IPv4) or ip6.arpa (IPv6) zones. Reverse DNS matters most
visibly in email: many receiving mail servers check that a sending IP's PTR record resolves back to a
plausible hostname before accepting mail from it.
Mail Records
MX records route incoming mail to the right server. Outbound mail authenticity relies on a separate set of records — SPF (which servers may send mail for this domain), DKIM (a cryptographic signature proving a message wasn't altered), and DMARC (a policy tying the two together and telling receivers what to do when checks fail). All three are commonly implemented as specially-formatted TXT records rather than their own dedicated DNS record type.
Security Records
CAA restricts which Certificate Authorities may issue TLS certificates for a domain. TLSA (DANE) lets a client verify a certificate against a value published directly in DNS. Together with SPF/DKIM/DMARC, these records form the practical DNS-level security toolkit most domains should configure, well beyond simply pointing a hostname at an IP.
DNSSEC
DNSSEC adds cryptographic signatures to DNS responses so a resolver can verify they haven't been tampered with in transit. Three record types work together: DNSKEY publishes a zone's public key, RRSIG is the signature over a set of records, and DS (published in the parent zone) links a child zone's key into a chain of trust rooted at the DNS root itself. Getting DNSSEC key rollovers wrong — updating a DNSKEY without the matching DS record — is one of the most common ways a domain accidentally makes itself unreachable for validating resolvers.
TTL (Time To Live)
Every DNS record carries a TTL, in seconds, telling resolvers how long they may cache it before asking again. A short TTL (minutes) means changes propagate fast but generates more query traffic; a long TTL (hours to a day) reduces load but slows down failover or migrations. Lowering the TTL in advance of a planned change is a standard practice that gives old cached copies time to expire before the actual cutover happens.
Common Mistakes
- Adding a CNAME at the domain apex. The bare domain (example.com, not a subdomain) can't have a CNAME because it must also carry SOA/NS records, which the standard disallows alongside a CNAME.
- Forgetting SPF/DKIM/DMARC alongside MX. Mail can be received without them, but outbound mail from the domain is far more likely to be marked as spam.
- Rotating a DNSSEC key without updating the parent's DS record. This breaks the chain of trust and can make the whole domain unresolvable for validating resolvers.
- Leaving stale records pointing at decommissioned infrastructure. A dangling A record or CNAME pointing at a service that's since been abandoned is a classic subdomain/IP takeover vector.
Related Tools
Working with DNS often overlaps with other developer utility tasks: look up what a header your DNS provider's API returned means with the API Header Inspector, decode a response status code with the HTTP Status Code Reference, inspect a Bearer token used to authenticate against a DNS API with the JWT Decoder, explain a scheduled zone-check job with the Cron Expression Parser, or convert a record's timestamp with the Unix Timestamp Converter.
Accuracy & Sources
Last reviewed: August 2026. Formula source: RFC 1035 — Domain Names, Implementation and Specification. All calculations run in your browser. No data is sent to any server.
Frequently Asked Questions
An A record points a hostname directly at an IPv4 address. A CNAME points a hostname at ANOTHER hostname, which is then resolved in turn. CNAMEs are useful for aliasing (like www pointing at the bare domain) but can't be used at the domain apex itself.
All three serve different, complementary purposes: SPF authorizes which servers may send mail for your domain, DKIM cryptographically signs messages to prove they weren't altered, and DMARC ties the two together with an enforcement policy and tells receiving servers what to do when checks fail. For real anti-spoofing protection, you want all three, not just one.
DNSSEC adds cryptographic signatures (via DNSKEY, RRSIG, and DS records) so a resolver can verify DNS responses haven't been tampered with in transit. It's not required for a domain to function, but it closes a real spoofing/cache-poisoning gap in plain DNS — many registrars and DNS providers support enabling it with a few clicks.
For stable records, an hour to a day (3600–86400 seconds) is typical. Lower it temporarily (e.g. to 300 seconds) in advance of a planned migration so old cached copies expire quickly once you make the actual change, then raise it back afterward.
No — it's a pure reference lookup against a fixed table explaining what each DNS record type means. It performs no live DNS queries and contacts no nameservers; it only explains a record type name you already have.
This tool covers 18 standard record types across forward/reverse lookup, mail, security, infrastructure, and DNSSEC categories. Less common or deprecated record types outside that list (like the historic HINFO or older WKS records) aren't in the lookup table.