Which resolver is used?

The primary resolver first (named in the report). SERVFAIL, timeout, or connection refused retries at 1.1.1.1 then 8.8.8.8 over HTTPS.

When is a domain called broken?

When the local resolver and the public fallbacks both fail. NXDOMAIN and empty records from the primary are not retried.

Why no DMARC pass without a record?

A false pass on email auth is worse than no check. We only pass p=quarantine or p=reject when the _dmarc TXT is on screen.

Why might DKIM look missing?

Selectors are not published as a list. We probe common names. Enter yours if you know it.

What counts toward SPF's 10 lookups?

include, a, mx, ptr, exists, and redirect, including nested includes. ip4 and ip6 do not count. Over 10 is a hard fail.

Why does an IP address fail Lookup DNS?

The field is a hostname. An IP returns Enter a hostname, not an IP address. example.com is the usual input. WHOIS / RDAP accepts public IPs and ASNs.

When are SPF, DKIM, and DMARC skipped?

When NS or SOA did not return records. Core A through TXT can still list. Mail auth needs a zone that answered those two types so we do not parse SPF on a broken name.

What does the fallback banner mean?

The primary resolver SERVFAILed, timed out, or refused. The same query went to 1.1.1.1, then 8.8.8.8, over HTTPS. NXDOMAIN and empty answers from the primary are not retried.

DNS Lookup

Loading tool…

About DNS Lookup

Enter a domain or URL (we use the hostname) and click Lookup DNS. Optional: a DKIM selector from your email provider. You get A, AAAA, MX, TXT, NS, CNAME, and SOA with TTL when the resolver returned one, plus parsed mail authentication. Copy any record. Empty types show as no data, not a fake pass.

Queries run against the primary resolver first. If that SERVFAILs, times out, or refuses the connection, the same query is retried over DNS-over-HTTPS at 1.1.1.1, then 8.8.8.8, and labeled as fallback. NXDOMAIN and empty records from the primary are not retried. Private A or AAAA answers are blocked.

When to use it

Use it after a nameserver change, or before a mail cutover, when you need A, MX, and the parsed SPF, DKIM, and DMARC on one screen instead of three terminal queries.

Also use it when a host looks down and you need to see whether the resolver returned NXDOMAIN or an empty A. It is not a WHOIS age report and not an SSL handshake.

How to use DNS Lookup

1Enter a domain. A URL is fine; we use the hostname. Optional: a DKIM selector from your email provider.
2Click Lookup DNS. Core records load first. Mail auth is skipped if NS or SOA is missing.
3Read mail auth, then raw types. SPF, DKIM, and DMARC are parsed. Then A through SOA.
4Copy a record. TTL sits beside each value when the resolver returned one.

Mail records and resolvers

SPF, DKIM, and DMARC run only when NS and SOA both returned records. SPF counts include, a, mx, ptr, exists, and redirect toward the 10-lookup limit (nested includes too). Over 10 is a hard fail. Multiple SPF records are critical. +all is a warning. DMARC is read from _dmarc.<domain>. A missing policy is a warning, never a silent pass. p=none is a notice; p=quarantine or p=reject is a pass when the record is on screen.

DKIM selectors are not listed in DNS, so we probe common names (google, selector1, k1, and others) plus any selector you enter. A miss is a notice that a selector we did not probe may still exist. CAA, SRV, and DNSSEC keys are not queried here.

How to read the results

Core types are A, AAAA, MX, TXT, NS, CNAME, and SOA, each with TTL when the resolver sent one. Empty types say no data. Mail auth sits above those rows when NS and SOA both returned records. Copy sits on each value.

example.com typically passes SPF and DMARC p=reject, and may notice DKIM for the common selectors we probe. An IP address is rejected: Enter a hostname, not an IP address. A fallback banner means 1.1.1.1 or 8.8.8.8 answered after the primary resolver SERVFAILed.

Why this matters

SPF's ten-lookup cap is a hard fail at the receiver. Nested includes count. A zone that looks fine in a web UI can still exceed ten and drop mail. That is why include, a, mx, ptr, exists, and redirect are counted here and ip4 is not.

DMARC without a visible _dmarc TXT is never a pass. A silent pass would hide a missing policy. p=none is a notice: the record exists but only monitors. NXDOMAIN on the primary is not retried, so a true missing name stays missing.

Limits and privacy

About 20 Lookup DNS runs per minute on your network. Enter a public hostname, not an IP. Private A and AAAA answers are dropped. Fallback is 1.1.1.1 then 8.8.8.8 over HTTPS. No login.

Common mistakes

Pasting an IP. The form wants a hostname. WHOIS / RDAP is the IP tool.

Reading No DKIM as proof the domain has none. Enter the selector your provider named.

Treating a fallback answer as your recursive resolver at the office. The label says which public resolver answered.

FAQs

Which resolver is used?: The primary resolver first (named in the report). SERVFAIL, timeout, or connection refused retries at 1.1.1.1 then 8.8.8.8 over HTTPS.
When is a domain called broken?: When the local resolver and the public fallbacks both fail. NXDOMAIN and empty records from the primary are not retried.
Why no DMARC pass without a record?: A false pass on email auth is worse than no check. We only pass p=quarantine or p=reject when the _dmarc TXT is on screen.
Why might DKIM look missing?: Selectors are not published as a list. We probe common names. Enter yours if you know it.
What counts toward SPF's 10 lookups?: include, a, mx, ptr, exists, and redirect, including nested includes. ip4 and ip6 do not count. Over 10 is a hard fail.
Why does an IP address fail Lookup DNS?: The field is a hostname. An IP returns Enter a hostname, not an IP address. example.com is the usual input. WHOIS / RDAP accepts public IPs and ASNs.
When are SPF, DKIM, and DMARC skipped?: When NS or SOA did not return records. Core A through TXT can still list. Mail auth needs a zone that answered those two types so we do not parse SPF on a broken name.
What does the fallback banner mean?: The primary resolver SERVFAILed, timed out, or refused. The same query went to 1.1.1.1, then 8.8.8.8, over HTTPS. NXDOMAIN and empty answers from the primary are not retried.