DNS Lookup — Query Any Record Type, Straight from Your Browser
Check the DNS records behind any domain: A and AAAA addresses, MX mail servers, TXT verification records, nameservers, and more. Queries go directly from your browser to Cloudflare or Google’s public DNS-over-HTTPS resolvers — orangebot never sees what you look up.
Private by design. Queries go directly from your browser to the public DNS-over-HTTPS resolver you select (Cloudflare or Google) — they never pass through orangebot servers and we cannot see what you look up.
FreeNo sign-upRuns in your browserDeveloperApplication
DNS record types, decoded
A domain’s DNS zone is a small database of typed records. Each type answers a different operational question — where the site lives, who takes its mail, which statements the owner publishes. These are the eight types this tool queries and what to look for in each.
| Record | Answers the question | Typical value | Gotcha to watch for |
|---|---|---|---|
| A | Which IPv4 address serves this name? | 93.184.216.34 | Multiple A records = DNS round-robin load balancing |
| AAAA | Which IPv6 address serves this name? | 2606:2800:220:1::1 | Missing AAAA is common — many sites are still IPv4-only |
| CNAME | Is this name an alias for another? | shop.example.com → shops.myshopify.com | A name with a CNAME cannot have other record types |
| MX | Which servers accept email? | 10 aspmx.l.google.com | Lower priority number wins; a missing MX silently kills inbound mail |
| TXT | What statements does the owner publish? | v=spf1 include:_spf.google.com ~all | SPF, DKIM, DMARC, and site-verification all crowd into TXT |
| NS | Which nameservers are authoritative? | dns1.registrar-servers.com | NS mismatch between registrar and zone causes intermittent failures |
| SOA | Who administers the zone, and how is it timed? | ns1.example.com admin.example.com 2026072101 … | The serial number should change every time the zone is edited |
| CAA | Which CAs may issue TLS certificates? | 0 issue "letsencrypt.org" | A CAA record naming the wrong CA blocks certificate renewal |
- DNS-over-HTTPS (RFC 8484) wraps the query in an encrypted HTTPS request, so networks between you and the resolver cannot read or tamper with your lookups — which is also what makes a purely in-browser tool like this possible.
- Propagation delay is not a mystery force: it is exactly the old record’s TTL. Lower the TTL to 300 before a planned migration and the switch completes in minutes.
How to look up DNS records for a domain
- Enter a domain. Type the bare domain, like example.com — a pasted URL is trimmed automatically. Subdomains such as mail.example.com work too.
- Pick a record type — or query all. Choose A, AAAA, CNAME, MX, TXT, NS, SOA, or CAA, or tick Query-all to fan out one request per type and see everything the domain publishes.
- Choose a resolver. Cloudflare (1.1.1.1) is the default; switch to Google (8.8.8.8) to compare answers or work around a resolver outage.
- Read the results. Each answer shows the record name, type, TTL in seconds, and value. Click any value to copy it.
Frequently Asked Questions
- Do my DNS queries go through orangebot servers?
- No. Your browser sends each query directly to the public DNS-over-HTTPS resolver you selected — Cloudflare’s cloudflare-dns.com or Google’s dns.google. We never see, log, or proxy your lookups.
- Is this the same as WHOIS?
- No. DNS lookup shows the live records a domain publishes (where it points, who handles its mail). WHOIS shows registration data — who registered the domain, when, and through which registrar. This tool does DNS only.
- What does TTL mean?
- Time To Live — how many seconds resolvers may cache the answer. A TTL of 300 means changes propagate within about 5 minutes; 86400 means up to a day.
- What does NXDOMAIN mean?
- The resolver is saying the domain does not exist in DNS at all — usually a typo, an expired registration, or a subdomain that was never created.
- Why do Cloudflare and Google sometimes return different answers?
- Caching. Each resolver caches records for the TTL duration, so right after a DNS change one resolver may still serve the old value. Both converge once caches expire.
- Which record type tells me where email goes?
- MX records list the mail servers that accept email for the domain, with priority numbers — lower numbers are tried first. SPF and DKIM policies live in TXT records.
Use Cases
- Verify an A-record change has propagated after moving a site to a new host
- Check MX records when debugging why email to a domain bounces
- Read TXT records to confirm SPF/DKIM/site-verification entries are set correctly
- Compare Cloudflare vs Google resolver answers during a DNS migration
- Audit NS and CAA records before renewing TLS certificates on a domain