DNS lookup
Look up any DNS record over HTTPS through Cloudflare and Google, compare the two side by side, check DNSSEC, and decode SPF, DMARC, and DKIM.
Added · updated 28 October 2026
Works with
- Packet capture viewer (mini Wireshark) Networkopens a name queried in a capture here to look it up live
How to use it
Enter a domain (or paste a URL — the host is taken from it) and pick a record type. All common
types sweeps A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, and HTTPS at once. Enter an IP address and
the tool looks up its reverse (PTR) name automatically, building the in-addr.arpa or
ip6.arpa name for you.
What it shows
-
Status — NOERROR, NXDOMAIN (the name does not exist), SERVFAIL (often a broken or DNSSEC-invalid zone), and the rest, with an explanation.
-
Flags —
ADis set when the resolver validated the answer with DNSSEC. Tick Disable validation (CD) to see answers a validating resolver would otherwise reject, and DNSSEC records (DO) to include RRSIG signatures. -
Records — name, type, TTL (in human units), and data. MX, SOA, SRV, CAA, DS, and DNSKEY records are split into labelled fields; TXT records that are SPF, DMARC, or DKIM are decoded term by term.
-
Compare both — queries Cloudflare and Google together and highlights records only one of them returned. Differences are normal for CDN and geo-routed names.
-
Check email records — MX, SPF, DMARC, MTA-STS, TLS-RPT, and BIMI for a domain, plus DKIM if you give a selector (find it as
s=in a message’s DKIM-Signature header). -
Copy dig copies a
dig-style text version; Copy URL the raw API request.
Link straight to a lookup with #q=example.com&type=MX, &r=compare, or &email=1.
Where your queries go
Queries are sent from your browser, over HTTPS, to Cloudflare’s resolver
(cloudflare-dns.com) and/or Google Public DNS (dns.google) using their JSON DNS-over-HTTPS
APIs. Nothing goes to this site. The EDNS client subnet option (Google only) asks the
resolver to answer as if you were in another network — useful for checking geo-routing. Recent
lookups are remembered in this browser only.
Sharing
Share link copies a URL that opens this tool exactly as configured. ?name= and ?type=, plus resolver (cloudflare, google, compare), do, cd, ecs, and dkim when set. A link only fills in the form — nothing is looked up until you press Look up. (Older #q=… links still run immediately.)
For example: dns/?name=github.com&type=MX.
Feedback is a gift. Something to improve, a feature to add, or a bug? Tell me.
Runs entirely in your browser — network requests go only to the services named on this page.