DNS lookup (nslookup)

See which DNS records a domain currently publishes – either as seen by a large public resolver or directly from the name server responsible for the domain.

20 of 20 checks left today

What does the DNS lookup show?

The Domain Name System translates names into technical details. An A record holds the IPv4 address of a server, AAAA the IPv6 address, MX the mail servers, NS the responsible name servers and TXT free text, used for example for SPF or domain verification. CAA defines which certificate authorities may issue certificates.

With “Main types” we query A, AAAA, CNAME, MX, NS, TXT, SOA and CAA one after the other. If you enter an IP address, we automatically look up the reverse record (PTR).

Public resolver or authoritative name server?

Public resolvers such as Cloudflare, Google or Quad9 cache answers for as long as the TTL (time to live) allows. After a change, the old value may therefore still show there for a while. That is why “Authoritative DNS” is preselected: it asks the zone’s responsible name servers directly – changes show up there immediately.

With “Custom name server …” you can enter any publicly reachable name server yourself – as an IP address or host name. Queries always use port 53. Internal and private addresses are blocked for security reasons.

Below the table you see the complete server response for every query in the format of the well-known dig program: header with status and flags plus all sections (question, answer, authority, additional) exactly as delivered by the server. All common record types can be selected, including ANY.

Frequently asked questions

Why do I still see the old record after a change?

Resolvers keep answers until the TTL expires. If it says 3600, for example, it can take up to an hour until the new value is visible everywhere. Use “authoritative” to check whether the change has already reached the name server.

What does NXDOMAIN mean?

The name does not exist in DNS. Common causes are a typo, a domain that has not been registered yet, or a missing record for a subdomain.

What is the AD bit?

If the resolver has verified the answer cryptographically with DNSSEC, it sets the AD bit (“authenticated data”). Our DNSSEC check looks at this in more detail.

Domains and DNS in good hands

1blu business GmbH looks after domains, DNS and mail servers for companies, agencies and resellers – with dedicated contacts instead of a call centre.