Start with the question
For a website’s address, look up A for IPv4 or AAAA for IPv6. Use CNAME to inspect an alias, MX for receiving mail routes, and TXT for published text such as provider verification tokens and email policies. For each result, check the returned owner name as well as the value.
A proxied website may expose CDN addresses instead of its origin. A flattened alias can produce address records without exposing its underlying CNAME. Neither result, by itself, proves a configuration error.
NS: where a zone’s answers come from
NS records name the servers responsible for a DNS zone. Query the zone’s domain, for example example.org, when looking for its nameserver set. Querying www.example.org asks about that exact name, which often has no NS records of its own.
This tool displays a recursive resolver’s answer. It does not trace parent delegation, test every authoritative server or confirm that every resolver sees the same configuration. Before changing nameservers, compare the active registrar settings and preserve the records your services need.
SOA: read the zone’s metadata
SOA contains a primary nameserver, a responsible-mailbox field in DNS form, a serial number and several time parameters. The serial is a zone version value, not necessarily a date. Refresh and retry concern secondary-server behavior; they are not a promise for when your website will update.
Our SOA view separates these fields. The record’s remaining TTL is shown independently from the minimum field used in negative caching. A SOA shown only in the raw response’s Authority section is not presented as a direct SOA answer for your queried name.
TXT: use the right name for the policy
SPF is normally a TXT record on the sending domain. For DMARC, enter _dmarc.example.org and choose TXT. For DKIM, ask the provider for the selector, then query selector._domainkey.example.org. Looking up TXT at the root does not automatically discover those other names.
A TXT record can contain multiple quoted character strings. The tool preserves their DNS presentation in the value and export rather than treating every quoted chunk as a separate record. Displaying a policy does not validate all of its mechanisms or prove that a real message passes authentication.
CAA, SRV and PTR
CAA publishes certificate-authority policy. This view shows records at the queried name, not a complete evaluation of inherited policy. SRV identifies a service destination using priority, weight, port and target; enter its full _service._protocol.example.org name.
PTR is reverse DNS. Enter an IPv4 or IPv6 address and we construct its reverse DNS name before querying. You can also supply an in-addr.arpa or ip6.arpa name directly. A reverse name is not evidence of who owns an IP or whether it is trustworthy.
Use the overview as a checklist
The overview makes eight explicit queries: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA. Each group retains its own response status and DNSSEC flag. A failed type remains a failure; it is never silently converted into “no records.”
It queries the name you enter. It is not a zone transfer, subdomain discovery tool or exhaustive record inventory. For SRV, DKIM and DMARC, enter the correct full name separately. Save a JSON export before and after a change to compare what the selected resolver actually returned.