DNS Lookup & Health Check
All of a domain's DNS records in one place, plus a health check of nameservers, CAA and DNSSEC.
Free · needs a free account · reads public data only
See your results in one click. Sign in with Google, then run any of the 150 free tools.
Continue with Google
A DNS lookup shows the public records that tell the internet where your website, email and services live. Our tool gathers the A, AAAA, NS, MX, TXT, SOA, CAA and CNAME records for a hostname in one go, then runs a short health check on nameserver redundancy, mail routing, certificate authority restrictions and DNSSEC. It is useful before and after a hosting or email move, when a site stops resolving, or when you simply need to know who controls a domain's DNS.
How to use the DNS lookup
- 1 Enter the root domain firstType example.co.uk rather than a page URL. Nameserver, SOA, MX and CAA records normally live at the root of the zone, so this gives the fullest health check.
- 2 Run the lookupSign in to your free account and start the check. We query each record type and ask a validating resolver about DNSSEC.
- 3 Check subdomains separatelyEnter www.example.co.uk or shop.example.co.uk on their own to see whether they use a CNAME or their own A records.
- 4 Read the health checks and the record listWork through any failures and warnings first, then use the record list to confirm values match what your DNS provider shows.
What DNS records do
DNS turns your domain into the addresses browsers and mail servers connect to. A and AAAA point to your web server, MX to your mail server, NS to the servers that hold your zone, and TXT carries verification and email-security records.
What this checker looks at
The A, AAAA, NS, MX, TXT, SOA, CAA and CNAME records, whether you have at least two nameservers, whether CAA restricts who can issue certificates, and whether the zone is DNSSEC-signed.
What a DNS lookup shows you
DNS is a distributed database. Your domain's records sit on its authoritative nameservers, and every visitor's resolver, usually run by their broadband provider or a public DNS service, asks those servers and caches the answer for the record's time to live (TTL). A DNS lookup asks the same questions a browser or mail server would and shows you the answers.
Each record type has a specific job, and most everyday problems come down to one record being missing, duplicated or pointing at the wrong place.
- A and AAAA: the IPv4 and IPv6 addresses of the server for that hostname.
- CNAME: makes one hostname an alias of another, such as www pointing at a hosting platform. It cannot coexist with other records on the same name.
- MX: the mail servers that accept email for the domain, each with a priority number where lower is tried first.
- NS: the authoritative nameservers for the zone, which decide where every other record is answered from.
- TXT: free text used for SPF, DKIM, DMARC and ownership verification for services such as Google and Microsoft.
- SOA: the start of authority, naming the primary nameserver, a contact and the zone serial number.
- CAA: the certificate authorities allowed to issue certificates for the domain.
How our DNS checker gathers the records
For the hostname you enter, the tool queries each record type through a recursive resolver, exactly as an ordinary client would. That means the answers reflect what the wider internet currently sees, including any caching. If you changed a record a few minutes ago and the old value had a long TTL, you may still see the old value here until that TTL runs out.
DNSSEC needs a different approach, because ordinary lookups cannot tell whether an answer was cryptographically validated. We ask a validating DNS-over-HTTPS resolver for the zone's DNSKEY record and look for two signals: the Authenticated Data flag, which the resolver only sets after validating the chain of signatures, or a DNSKEY record in the answer. If that resolver cannot be reached, the DNSSEC row is shown as information and does not affect your score.
We also look at the nameserver hostnames and, where they match a well-known provider such as Cloudflare, AWS Route 53, Google Cloud DNS, Azure DNS, GoDaddy or Namecheap, show the DNS provider. Results are cached for ten minutes per domain, and the DNSSEC status for an hour.
Reading the DNS health check results
TXT records are listed but not graded here. To test SPF, DKIM and DMARC in detail, use our email deliverability tools.
- A record resolves (pass) or A record none (fail): without an A record the hostname has no IPv4 address, so most visitors cannot reach it.
- IPv6 (AAAA) record (information): lists IPv6 addresses or shows not configured. Missing IPv6 is common and does not lower the score.
- Multiple nameservers (pass), Only one nameserver (warning) or none (fail): two or more nameservers keep the domain resolving if one goes down.
- SOA record present (pass) or missing (warning): the primary nameserver named in the zone's start of authority.
- CAA record present (pass) or not set (warning): when missing, we suggest a record, shown for Let's Encrypt as a placeholder to replace with your real authority.
- Mail servers (MX) configured (pass) or none (warning): with no MX records the domain cannot receive email.
- DNSSEC enabled (pass), not enabled (warning) or could not be verified (information).
Fixing common DNS problems step by step
First confirm where your DNS is really hosted: the NS records decide this, not the company you bought the domain from. Editing a zone at your registrar has no effect if the nameservers point to Cloudflare or your web host. Make every change in the panel that matches the NS records.
No A record: in cPanel, open Zone Editor and add an A record for the domain pointing at your hosting IP address, which is shown on the cPanel home screen. On Cloudflare, add it under DNS, Records, and decide whether it should be proxied. For the bare domain, use an A record or your provider's ALIAS or CNAME flattening feature, because a plain CNAME is not allowed at the zone apex.
Only one nameserver: ask your DNS host for its second nameserver and add both at your registrar. For .uk domains this is done through your registrar, which updates Nominet for you.
No CAA record: find out which authority issues your certificates, then add a CAA record for it. If you use Cloudflare's proxy, its Universal SSL authorities are added automatically once you create CAA records, but check the list before relying on it.
DNSSEC not enabled: switch on signing at your DNS host, copy the DS record it gives you, and add that DS record at your registrar. On Cloudflare this is under DNS, Settings. Many cPanel hosts offer DNSSEC in Zone Editor where the server supports it.
Moving DNS provider without breaking email or your website
Most DNS outages happen during a move, usually because a record was not copied. Before changing nameservers, run a DNS lookup on the root domain and on each subdomain you use, and save the results. Export the zone file from the old provider if it allows it.
Recreate every record at the new provider, paying special attention to MX records and TXT records for SPF, DKIM, DMARC and service verification, which are easy to miss because nothing visibly breaks straight away. If DNSSEC is on, remove the DS record at the registrar and wait for it to expire before switching. Then change the nameservers, and run the lookup again over the next day to confirm the new records are being served.
DNS best practice for UK businesses
A tidy zone is easier to hand over. When an agency, freelancer or new IT provider takes over, a saved lookup and a short note per record save hours of guesswork.
- Use at least two nameservers, ideally on separate networks, which every major DNS provider gives you by default.
- Protect your registrar and DNS accounts with two-factor authentication. Whoever controls DNS controls your website and email.
- Keep a single SPF TXT record per hostname and remove verification records for services you no longer use.
- Publish a CAA record with an iodef contact so refused certificate requests are reported.
- Use moderate TTLs such as one hour for most records, and document every record and why it exists.
- Run a DNS lookup after any change by a developer, host or agency to confirm nothing else moved.
Examples you can copy
Zone file: bare domain on an A record, www as a CNAME, and two mail servers by priority
example.co.uk. 3600 IN A 203.0.113.10
www.example.co.uk. 3600 IN CNAME example.co.uk.
example.co.uk. 3600 IN MX 10 mx1.example.co.uk.
example.co.uk. 3600 IN MX 20 mx2.example.co.uk.CAA records for Let's Encrypt with a reporting address (replace with your own authority)
example.co.uk. 3600 IN CAA 0 issue "letsencrypt.org"
example.co.uk. 3600 IN CAA 0 issuewild ";"
example.co.uk. 3600 IN CAA 0 iodef "mailto:security@example.co.uk"A single SPF TXT record covering Microsoft 365 and a website mailer
example.co.uk. 3600 IN TXT "v=spf1 include:spf.protection.outlook.com a -all"Look up records yourself from a terminal
dig +short NS example.co.uk
dig +short MX example.co.uk
dig +short CAA example.co.uk
dig +dnssec DNSKEY example.co.ukCommon mistakes to avoid
Editing DNS in the wrong place
Changes made at a registrar or old host do nothing if the NS records point elsewhere. Check the nameservers first and edit the zone there.
Publishing two SPF records
Receivers treat two v=spf1 records as an error, so SPF fails for every message. Merge them into one record.
A CNAME on the bare domain
A CNAME cannot sit alongside the SOA, NS and MX records the apex needs, which can break email. Use an A record or your provider's ALIAS or flattening feature.
Doubling the domain in a zone editor
Typing www.example.co.uk into a name field that already appends the domain creates www.example.co.uk.example.co.uk. Enter just www, or end the full name with a dot where the editor expects it.
Leaving an old DS record after moving DNS
Validating resolvers reject answers signed with the wrong key, so the domain stops resolving for many users. Remove the DS record before moving and add the new one afterwards.
Pointing MX at an IP address or a CNAME
MX records must name a hostname that has its own A or AAAA record. Point them at the mail server hostname your provider gives you.
Frequently asked questions
Resolvers cache records for their TTL. A change can take from a few minutes to the old TTL to show everywhere — lower the TTL a day before planned changes.
It protects against forged DNS answers and is worth enabling if your registrar and DNS host both support it. Disable it before moving DNS providers, or the domain can stop resolving.
It lists the certificate authorities allowed to issue certificates for your domain, so a mis-issued certificate from another CA is refused.
A DNS lookup shows the technical records that route traffic, such as A and MX. WHOIS, now largely replaced by RDAP, shows registration facts such as the registrar and expiry date, which our domain age checker covers.
Look at the NS records. The nameserver hostnames usually name the provider, and our tool shows the provider where it recognises them.
Either the old values are still cached until their TTL expires, or you are editing a zone that is not authoritative because the nameservers point somewhere else.
Yes. Enter the full subdomain to see its A, AAAA or CNAME records. Zone-level records such as NS and SOA usually only appear on the root domain.
No. It looks up forward records for the hostname you enter. Reverse DNS for a mail server IP is set by whoever owns that IP, usually your host or email provider.
The hostname has no IPv6 address. Visitors on IPv6 networks still reach it over IPv4, so it is not an error, just an optional extra.
Learn more
- DNS over HTTPS Explained: DoH, DoT and DNSSEC Compared DNS over HTTPS explained: how DoH and DNS over TLS protect privacy, how browsers and Windows use them, what they mean for filtering, and how DNSSEC differs.
- IPv6 for Small Business Websites: Do You Need AAAA? IPv6 for small business websites: how many users have it, whether you need an AAAA record, hosting and CDN support, IPv6 email PTR and SPF rules, and testing.
- DNS Records Explained: A, AAAA, CNAME, MX, TXT, NS and SOA A plain-English guide to DNS records: what A, AAAA, CNAME, MX, TXT, NS and SOA records do, with real zone examples and the mistakes that break sites and email.
- What Is DNSSEC? How It Works and When to Enable It DNSSEC explained without jargon: how signatures and DS records work, whether your domain should use it, and how to avoid outages when changing DNS providers.
- CAA Records Explained: Control Who Issues Your SSL Certificates Learn what a CAA record does, how certificate authorities check it, and how to set CAA records for Let's Encrypt, Cloudflare and AWS without breaking renewals.
- DNS Propagation Explained: TTLs, Caching and Safe DNS Changes Why DNS changes take time to show up, what TTL really controls, and a step-by-step plan for changing records or nameservers without downtime or lost email.
- eMudhra Certificate Compromise: Is Your Website's SSL Certificate Affected? Eight eMudhra intermediate CA keys were found to be weak in October 2026 and browsers pulled trust. How to check whether your SSL certificate is affected.
- Which Domain Extension Is Best? .com vs .ai, .io, .co and Country Codes Which domain extension is best for your business? Compare .com, .ai, .io, .co, country codes and new gTLDs on SEO, trust, cost, eligibility and risk.
- Let's Encrypt 64-Day Certificates: Test Your Renewals Before February 2027 Let's Encrypt scheduled 64-day staging certificates from October 14, 2026, before they become the default on February 10, 2027. How to check your renewals.
Free website audit
See how your site scores, free
Speed, SEO, DNS, email (SPF/DKIM/DMARC) and security in one scan, with a prioritised fix list.