← ALL TOOLS
// RECON & INTEL · SERVER

DNS Lookup

Resolve A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records for a domain, with TTLs and the DNSSEC flag.

RECON · SERVER-SIDE · RATE LIMIT 30/MIN

Rate limited: 10 runs in a burst, 30 per minute. Results are never stored. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

DNS Lookup queries A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records for a domain (or all eight at once) and shows the answer our resolver got right now, with each record's TTL and whether the resolver reported the answer as DNSSEC-validated.

How to read the result

The result is a table of type, name, value and TTL, one row per record. The line under it names the resolver that answered ("system" means the server's own resolver) and the DNSSEC status, taken from the AD (Authenticated Data) bit: "validated" means the chain of trust checked out, "not validated" means the zone is not signed or the resolver did not validate it.

The tool takes a public domain name only: an IP address belongs in Reverse DNS, and a name that resolves to a private address is refused.

A TTL of 300 means the record is cached for five minutes elsewhere; if you just changed a record and still see the old value, that cache has not expired yet.

Defender tips

  • Set TTLs deliberately: short (300s) before a planned migration, longer once settled, so caches do not amplify an outage or slow a rollback.
  • Publish a CAA record restricting issuance to the certificate authorities you actually use; it is one line and it blocks mis-issuance from unrelated CAs.
  • Check that your NS records match what your registrar has on file and point only at DNS providers you still use; a delegation to a provider account you have closed is how domains and subdomains get taken over.

FAQ

Why does it say DNSSEC is not validated for my domain?

Either the zone is not signed with DNSSEC, or the resolver we queried does not validate it. An unsigned zone is common and not itself a finding, but it means responses cannot be cryptographically verified end to end.

What is a CAA record for?

CAA (Certification Authority Authorization) tells certificate authorities which of them are allowed to issue certificates for your domain. Without one, any public CA can issue a certificate for it.

Why do I see multiple A records?

The domain has more than one IP address, typically for load balancing or a CDN. Any of them can answer a request.