How to use it
- Type a domain name, such as example.com, in Domain name. A web address also works.
- Choose a Record type. Common types shows A, AAAA, CNAME, MX, TXT and NS together.
- Choose a Resolver. For public domain names, Cloudflare and Google give the same answers.
- Read the table. For mail servers, the lowest Priority number is tried first.
Where the question goes
Your browser sends the question straight to the resolver you chose: Cloudflare (cloudflare-dns.com) or Google (dns.google). It uses the DNS over HTTPS JSON interface of each service, so this page has no server of its own between you and the resolver.
As with any DNS lookup, the resolver sees the name you ask for, the record type and the IP address your query comes from. It does not see the rest of this page. We do not store your queries or the answers.
- A resolver keeps each answer for its TTL, so a record you have just changed can look old for that long.
- The result shows what the resolver returned at this moment. It does not prove that a website works or that e-mail arrives.
Record types
Every record has a type, a name, a value and a TTL: the number of seconds a resolver may keep the answer before it asks again. These are the types this tool reads.
| Type | What it holds |
|---|---|
| A | The IPv4 address of a name |
| AAAA | The IPv6 address of a name |
| CNAME | An alias that points to another name |
| MX | A mail server and its priority: the lower number is tried first |
| TXT | Text, such as SPF policies and domain verification codes |
| NS | The name servers that are authoritative for the domain |
| SOA | The primary name server, the zone serial and its timers |
| CAA | The certificate authorities allowed to issue certificates, RFC 8659 |
| SRV | The host and port of a service, RFC 2782 |
| PTR | The name of an IP address, used for reverse DNS |
| DS, DNSKEY | The keys and digests of DNSSEC |
| HTTPS | Settings for an HTTPS connection, RFC 9460 |
Status and the AD flag
NOERROR means the resolver answered. If the name has records of the type you asked for, they are listed; if not, the result says so. NXDOMAIN means the name does not exist. SERVFAIL means the resolver could not produce an answer.
The AD flag means the resolver checked the DNSSEC signatures of the answer and found them valid. Without AD the answer is not necessarily wrong: most domains are not signed, and not every resolver checks signatures.
Example: the mail servers of gmail.com
Choose MX and type gmail.com. The resolver answers with five mail servers. Each has a priority: a sending server tries the lowest number first and uses the others if it cannot connect.
The table is the answer of 2026-11-10, sorted by priority. Mail servers change over time, so the records you see may differ.
| Priority | Mail server |
|---|---|
| 5 | gmail-smtp-in.l.google.com |
| 10 | alt1.gmail-smtp-in.l.google.com |
| 20 | alt2.gmail-smtp-in.l.google.com |
| 30 | alt3.gmail-smtp-in.l.google.com |
| 40 | alt4.gmail-smtp-in.l.google.com |
Frequently asked questions
What is a DNS lookup?
It asks the Domain Name System which records belong to a name: the IP address of a website, its mail servers, its text records and more. Each record has a type and a TTL, the time a resolver may keep the answer.
What does NXDOMAIN mean?
The resolver found no such name. Check the spelling first. A record that was just added may not show until the resolvers' copies expire, so wait for its TTL and try again.
What does the AD flag show?
AD means the resolver checked the DNSSEC signatures of the answer and found them valid. Without AD the record may still be correct, because many domains are not signed and some resolvers do not check signatures.
Should I choose Cloudflare or Google?
For public domain names both return the same records. Use either one, and switch if one does not answer. Both are public services, so the lookup is no more private with one than with the other.
Can the resolver see what I look up?
Yes. It receives the name, the record type and the IP address the query came from, as with any DNS lookup. HTTPS hides the query from people on the network, such as your Wi-Fi provider, but not from the resolver. This page sends your query to no other service.
Why does the TTL matter after a change?
The TTL tells resolvers how long they may keep an answer. After you change a record, the old answer can stay in caches until its TTL runs out, so the new value may take that long to appear everywhere.
Sources
- Cloudflare: DNS over HTTPS, JSON API
- Google Public DNS: DNS over HTTPS, JSON API
- RFC 1035: Domain names, implementation and specification
- IANA: DNS parameters (record type numbers and response codes)
- RFC 8659: DNS Certification Authority Authorization (CAA)
- RFC 2782: A DNS RR for specifying the location of services (SRV)
- RFC 9460: Service Binding and Parameter Specification via the DNS (HTTPS record)
Figures and text last checked on Tuesday, November 10, 2026.