Resolve
DNS lookup and record checker
What each record type is for
A and AAAA point a name at an address — IPv4 and IPv6 respectively. CNAME points one name at another name instead, which is how most hosting providers ask you to configure a subdomain. MX says which servers accept mail for the domain, in priority order where the lowest number is tried first.
NS lists the nameservers that are authoritative for the zone — change these and you have moved your DNS hosting entirely. TXT is a free-text record that has been quietly overloaded to carry SPF policies, DKIM keys, DMARC settings and domain-ownership proofs for half the services on the internet. SOA holds the zone's serial number and timing values, and CAA restricts which certificate authorities may issue for the domain.
A CNAME on the bare domain is a trap
RFC 1034 does not allow a CNAME to coexist with other records at the same name, and a
bare domain always has other records — its NS and SOA at minimum. Point
example.com itself at a CNAME and you can break mail delivery and
nameserver resolution for the whole zone.
Providers that appear to support it are using a non-standard flattening trick, usually called ALIAS or ANAME, which resolves the target and serves an A record in its place. That works, but it is your provider's feature rather than a DNS one — so it does not survive moving to a provider that lacks it. This tool flags the case when it sees it.
Why answers can disagree
DNS is a cache, layered many times over. Every record carries a TTL — a time to live — and resolvers are entitled to keep serving the old answer until it expires. So a change you made twenty minutes ago may be visible from one network and invisible from another, and both are behaving correctly.
The practical consequence: before a migration, lower the TTL on the records you intend to change, wait for the old TTL to expire, and only then make the change. Doing it in the other order means the world caches the old answer for however long the old TTL said, and there is nothing you can do to hurry it.
Things worth checking that people rarely do
Two nameservers, minimum. One is a single point of failure for the entire domain, including mail. Most registrars provide several by default, but a hand-configured zone often ends up with one.
CAA records. Without them, any certificate authority in the world may issue a certificate for your domain. With them, only the ones you name can. It is two minutes of work and it closes off a whole category of mis-issuance.
An AAAA record. A domain with no AAAA is unreachable over IPv6, which a growing share of mobile networks now use natively.
This tool uses the util.quest server. It cannot run in your browser — the work is either impossible there or too heavy for it. What you submit is sent to this server, used to produce the result, and not stored afterwards. Requests are rate limited, and nothing about them is logged beyond what is needed to enforce that.
Look up any domain's A, AAAA, MX, TXT, NS, CNAME and SOA records, with the answers a browser can never give you — because browsers have no DNS API at all. Shows what each record means rather than only what it says, so a misconfigured mail exchanger is obvious rather than merely visible.
It's one of the free tools in the util.quest collection — nothing to install, and no account needed. Found a bug or want a feature? Reach out at [email protected].
