DNS lookup

Check the DNS records of any domain: A and AAAA (IP addresses), MX (mail), TXT (SPF, DKIM, verification), NS, CNAME and SOA. Queries go to Cloudflare’s 1.1.1.1 resolver over encrypted DNS-over-HTTPS.

What each DNS record type means

A: The IPv4 address the name points to, e.g. 93.184.215.14. This is what browsers connect to.
AAAA: The IPv6 address. Sites with both A and AAAA records are reachable over either protocol (test your IPv6).
MX: Mail exchangers: the servers that accept email for the domain, with a priority (lower is tried first).
TXT: Free-form text. Used for SPF (which servers may send mail), DKIM keys, DMARC policy and ownership checks such as google-site-verification.
NS: The authoritative name servers for the domain, which hold the real records.
CNAME: An alias: this name is another name, e.g. www pointing to a hosting provider.
SOA: Start of authority: the primary name server, admin contact and timers for the zone.

How DNS resolution works

When you type a domain into a browser, your device asks a recursive resolver (usually your ISP’s, or a public one like 1.1.1.1 or 8.8.8.8) for the address. If it hasn’t cached the answer, the resolver asks the root servers which servers handle the top-level domain, asks those which name servers handle the domain, and finally asks the domain’s own authoritative servers for the record. Each answer carries a TTL, the number of seconds it may be cached. FernTool shows the TTL beside each record so you can see how long a change will take to spread.

Troubleshooting with a DNS lookup

Website not loading after a move? Check the A, AAAA and CNAME records point at the new host. A stale AAAA record is a common cause of “works for some people, not others”.
Email bouncing or going to spam? Confirm the MX records, then look in TXT for exactly one v=spf1 record and a DMARC record at _dmarc.yourdomain.com.
Domain verification failing? Look up the TXT records. If your verification string isn’t there yet, wait for the TTL or check you added it at the provider that actually hosts your DNS (the NS records tell you which one).
Changed name servers? Compare the NS records here with the ones in the WHOIS record. The registry’s copy updates first, and resolvers follow as caches expire.

Why DNS-over-HTTPS?

Classic DNS travels unencrypted, so anyone on the network path can see and tamper with lookups. DNS-over-HTTPS wraps queries in normal HTTPS. FernTool’s server queries Cloudflare this way, and the DNSSEC validated flag tells you when the answer was cryptographically signed by the domain owner and checked by the resolver. You can turn on secure DNS in your own browser’s privacy settings, which also helps against the DNS leaks covered in our VPN leak test.

Frequently asked questions

What is a DNS lookup?

A DNS lookup asks the Domain Name System for the records stored for a domain name: the IP addresses it points to (A and AAAA), its mail servers (MX), text records (TXT), name servers (NS), aliases (CNAME) and zone details (SOA).

Which DNS server does FernTool use?

FernTool queries Cloudflare’s public resolver 1.1.1.1 over DNS-over-HTTPS. That shows what most of the internet sees, rather than a cached answer from your own ISP or router.

Why don’t my new DNS records show up yet?

Resolvers cache records for the TTL (time to live) shown next to each record. After a change, old answers can persist until the TTL runs out, from a few minutes to 48 hours for NS records at the registry.

How do I check a domain’s MX records?

Enter the domain and look at the MX section. Lower priority numbers are tried first. Microsoft 365 domains point to *.mail.protection.outlook.com and Google Workspace to smtp.google.com or aspmx.l.google.com.

What does NXDOMAIN mean?

NXDOMAIN means the name does not exist in DNS: the domain is unregistered, or the subdomain has no records at all. An empty result with NOERROR means the name exists but has no record of that type.

More network tools

API: GET /api/dns/{domain}?type=A,MX (types: A, AAAA, MX, TXT, NS, CNAME, SOA) · MCP tool dns_lookup. Resolver: Cloudflare 1.1.1.1.