DNS Record Checker
Look up any DNS record type for a host.
Enter a host and pick a record type to look up its live DNS records, the values and their TTLs. We read straight from DNS over an encrypted connection. Nothing is stored.
The DNS Record Checker queries the public Domain Name System for any record type on a host you specify and returns the live answers as resolvers see them. You can look up A and AAAA records for IP addresses, MX for mail routing, TXT for SPF, DKIM and DMARC policy, CNAME aliases, NS and SOA for the authoritative zone, CAA for certificate authorisation, and PTR for reverse lookups. It is the quickest way to confirm what is actually published versus what you intended to publish.
Why DNS underpins email authentication
Every part of email authentication lives in DNS. SPF, DKIM and DMARC are all TXT records; MTA-STS and TLS-RPT publish TXT records too, with the MTA-STS policy served over HTTPS from a host pointed to by a CNAME. If a record is missing, sitting on the wrong host name, or has not propagated, authentication silently breaks. Checking the record at source removes the guesswork before you blame the receiving server.
Reading the result
Confirm three things in the output:
- The record exists on the exact host you queried. A DMARC record, for example, lives at
_dmarc.example.com, not the apex. - The value is correct and complete, with no truncation or stray quotes.
- The TTL is sensible. A long TTL means recent changes may still be cached for a while.
If a lookup returns nothing, check you queried the right host and that the record was saved at your DNS provider; allow time for the previous TTL to expire before re-testing. For email-specific records, the dedicated DMARC, SPF and DKIM checkers parse and validate the contents for you, and our audit guide ties it all together.
Frequently asked questions
Which record types can I look up?
Common types include A and AAAA (addresses), MX (mail servers), TXT (SPF, DKIM, DMARC, verification strings), CNAME (aliases), NS and SOA (authority), CAA (certificate authorisation) and PTR (reverse DNS). Pick the type that matches what you need to verify.
Why does my newly added record not show up yet?
Resolvers cache answers for the duration of the previous record's TTL, so a change can take from a few minutes to many hours to be visible everywhere. If the old value is still appearing, wait for that TTL to expire, then check again.
Where do email authentication records live?
DMARC is a TXT record at _dmarc.yourdomain; DKIM is a TXT record at selector._domainkey.yourdomain; SPF is a TXT record at the domain apex. Querying the wrong host is the most common reason a record appears missing.
What is a CNAME and why might it matter for email?
A CNAME aliases one host name to another. Many providers ask you to add CNAMEs for DKIM keys or for the MTA-STS policy host so they can manage the underlying value for you. If a CNAME is missing or points to the wrong target, the dependent feature will fail.
What does a CAA record do?
A CAA record names which certificate authorities are permitted to issue TLS certificates for your domain. It does not affect mail delivery directly, but it hardens the domain against unauthorised certificate issuance, which supports MTA-STS and DANE.
Does this tool query authoritative servers or a cache?
It resolves the record through public DNS, so you see the answer as a typical receiver would, including any cached value. To confirm what is truly published before propagation completes, query your DNS provider's own dashboard as well.