Skip to main content
MyIPKit— Your network, explained.

DNS Lookup

Read the DNS records a domain publishes, straight from a public resolver, with TTL and DNSSEC status.

Domain only — no http://, path, port or query string.

Try:

Lookups are processed on request and are not stored. MyIPKit keeps no record of what you look up.

How to use this tool

Enter a domain name, choose a record type and select Look up. Changing the record type after a search re-runs it immediately.

What each record type is for

  • A — the IPv4 address a name resolves to.
  • AAAA — the IPv6 address a name resolves to.
  • CNAME — an alias pointing at another name. A name with a CNAME cannot have most other record types at the same level.
  • MX — which servers accept mail for the domain, and in what priority order.
  • TXT — free-form text. In practice this carries SPF policies, DKIM keys, DMARC policies and domain-ownership verification strings.
  • NS — the nameservers that are authoritative for the zone.
  • SOA — the zone’s primary nameserver, its administrative contact, its serial number and the timers that govern zone transfers and negative caching.
  • CAA — which certificate authorities are permitted to issue certificates for the domain.

Reading the resolver response

NOERROR means the query succeeded; it does not mean records were found. NXDOMAIN means the name does not exist at all. SERVFAIL usually points at a broken delegation or a DNSSEC validation failure.

The DNSSEC line reports whether the resolver was able to validate the signature chain for the answer. “Not validated” is normal for the many zones that are not signed.

Limitations

  • Answers come from one public resolver. They reflect what that resolver has cached, not necessarily what every resolver worldwide is serving.
  • Propagation checking across multiple resolvers is not part of this release.
  • Only the record types listed above are supported. Zone transfers and ANY queries are deliberately not offered.
  • To query the resolver your own network handed you, see the local checks page.

Why do I get a different answer than my computer does?

MyIPKit queries Cloudflare’s public resolver over DNS-over-HTTPS. Your computer uses whichever resolver your network hands it, which may still be serving a cached copy of an older record, or may be a private resolver with different answers for internal names.

What does TTL mean?

Time to live: how long a resolver is allowed to cache this record before asking again. A record with a 300 second TTL can still be served from caches for five minutes after you change it, which is why DNS changes appear to take effect gradually.

Why is there no answer but the domain clearly works?

A domain publishes different record types independently. A NOERROR response with no answers means the name exists but has no record of the type you asked for — for example, a domain with only IPv4 hosting returns nothing for AAAA.