DNS Lookup, Explained
After reading this you can query any domain's A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records over encrypted DNS-over-HTTPS, read the TTLs, and tell whether an answer is fresh or stale.
What a DNS lookup actually returns
The Domain Name System maps human names like example.com onto the data a program needs to reach a service: an IPv4 address, an IPv6 address, the mail servers, and more. A lookup is a question and answer. You ask "what are the A records for example.com?" and a resolver answers with a list of records, each carrying a value and a time-to-live (TTL) in seconds.
Here is the hook. Type example.com and pick record type A. You get back 93.184.216.34 with a TTL like 300. That single line tells you three things: the name resolves, it points at that address, and any resolver may cache the answer for 300 seconds (5 minutes) before asking again. Change the type to MX and the same name returns its mail exchangers instead. Same question shape, different record type, different data.
DNS-over-HTTPS (DoH) is defined in RFC 8484... the important part for you: instead of sending the query as plaintext UDP on port 53, your browser sends it inside an HTTPS request to a resolver such as Cloudflare (1.1.1.1) or Google (8.8.8.8). The query and answer are encrypted in transit. Nobody on the path between you and the resolver can read or tamper with the record names.
The record types and what each one is for
DNS carries many record types. The tool covers the eight you touch most.
- A
- Maps a name to one IPv4 address, four bytes written as four decimals, for example
93.184.216.34. RFC 1035, type code 1. - AAAA
- Maps a name to one IPv6 address, sixteen bytes in colon-hex, for example
2606:2800:220:1:248:1893:25c8:1946. RFC 3596, type code 28. - MX
- Mail exchanger. Each record has a preference number and a hostname. Lower preference is tried first. RFC 5321 section 5.
- TXT
- Free-form text. Used for SPF, DKIM, domain verification tokens and more. A single TXT string is capped at 255 bytes; longer values are split into several strings that are concatenated.
- NS
- The authoritative nameservers for the zone. These are the servers that hold the real answers.
- CNAME
- An alias.
www.example.com CNAME example.commeans "look up the target name instead." A name with a CNAME cannot have most other record types at the same label. - SOA
- Start of authority: the primary nameserver, the admin email, a serial number, and the refresh, retry, expire and minimum timers for the zone.
- CAA
- Certification Authority Authorization (RFC 8659). Lists which certificate authorities may issue certificates for the domain.
When to use a DNS lookup, and when not
Reach for a lookup when you need ground truth about names and addresses: confirming a new A record went live, checking that MX points at the right mail provider, reading an SPF record in TXT before an email deliverability change, or listing NS records to confirm a delegation. A CAA check before requesting a certificate saves you a failed issuance.
Do not use DNS to check whether a host is up; that is what a ping or an HTTP request is for. A record can resolve perfectly while the server behind it is off. Do not use DNS to read registrar data such as the owner or the expiry date; that lives in WHOIS. And do not treat a lookup as proof that everyone sees the same answer. You see what your chosen resolver has cached right now.
DNS-over-HTTPS hides your query from the network between your browser and the resolver. It does not hide it from the resolver itself. Cloudflare or Google still sees every name you ask about. Choose the resolver you trust.
TTL: the one number that explains stale answers
Every record carries a TTL in seconds. It is a caching budget, not a countdown you control. When a resolver fetches a record with TTL 3600, it may serve that same value to anyone who asks for the next 3600 seconds (1 hour) without checking the source again.
Here t_{\text{stale}} is how many seconds a cached copy may still be served, TTL is the record's published value, t_{\text{cached}} is when the resolver first fetched it, and \text{now} is the current time. When the right side reaches 0, the resolver must ask again. This is why a record you changed can keep showing the old value: somewhere along the path a resolver is still inside its TTL window.
Worked number: you change an A record at 12:00 while its TTL is 3600. A resolver that cached the old value at 11:45 will keep serving it until 11{:}45 + 3600\,\text{s} = 12{:}45. That is up to 45 minutes of stale answers, even though you made the change on time. Lower the TTL to 300 a day before a planned change and the worst case drops to 5 minutes.
A worked lookup you can reproduce
Querying example.com, record type A
Load the tool with its defaults (domain example.com, type A, resolver Cloudflare) and press the query button. Follow the round trip:
- Your browser sends an HTTPS GET to
https://cloudflare-dns.com/dns-query?name=example.com&type=Awith the headeraccept: application/dns-json. - Cloudflare resolves the name, consulting the root, the
.comnameservers and the authoritative servers if it has nothing cached. - It replies with JSON. The
Answerarray holds one object:{"name":"example.com","type":1,"TTL":300,"data":"93.184.216.34"}. - The tool reads
type1 asA, shows the address93.184.216.34, and prints the TTL300.
Switch the type to MX and query again. The answer now lists mail exchangers with preference values. Switch to NS and you see the authoritative nameservers, typically two or more for redundancy. Same domain, three different views of its DNS data.
Reading and interpreting the results
Two fields in every answer deserve attention: the value and the TTL. The value must match what you expect from your zone file or DNS provider. If it does not, and the TTL is nonzero, you may be looking at a cached copy; wait out the TTL and query again, or query the other resolver to cross-check.
Empty results are meaningful. An A lookup with no answer and an MX lookup that returns something tells you the name handles mail but has no direct IPv4 host, which is normal for a bare mail domain. A CNAME at the queried label means the real answer lives at the target name; the resolver usually follows the chain and hands you the final A or AAAA record too.
| Type | Example value | What it tells you |
|---|---|---|
| A | 93.184.216.34 | IPv4 host to connect to |
| MX | 10 mail.example.com | Send mail here; 10 is the preference |
| TXT | v=spf1 include:_spf.google.com ~all | SPF policy for sending mail |
| CAA | 0 issue "letsencrypt.org" | Only Let's Encrypt may issue certs |
| NS | ns1.example.net | Authoritative server for the zone |
Common mistakes
The biggest error is reading a cached answer as the truth right after a change. If you edited a record 10 minutes ago and its TTL is 3600, the old value can persist for another 50 minutes. Check the TTL before you conclude your change failed.
A few more traps. People add a CNAME on a label that already has other records; DNS forbids this and resolvers behave unpredictably, so the apex of a domain (the bare example.com) can rarely be a CNAME. People forget that TXT records over 255 bytes are stored as several strings and must be joined before parsing, so a DKIM key can look truncated when it is not. And people assume MX preference is a percentage; it is only an ordering, lower first, with ties load-balanced.
Finally, do not confuse "resolves" with "reachable." The lookup confirms the mapping exists. Whether the host answers on port 443 is a separate question your browser or a connection test must settle.
Related tools
Once a name resolves to an address, the Subnet / CIDR calculator tells you which network that address sits in. To read the registrar, creation date and delegated nameservers behind a domain, use the WHOIS lookup. After a CAA check, paste the served certificate into the SSL certificate decoder to confirm the subject, issuer and validity dates line up. If you are also tracing a device on the local network, the MAC address lookup identifies the hardware vendor, and the Chmod calculator helps when you land on the server and need to fix file permissions.
Frequently asked questions
Why do Cloudflare and Google show different answers?
Each resolver caches independently. If you changed a record recently, one may still hold the old value while the other has already refreshed. Compare both and trust the one whose TTL is lower or whose value matches your zone file.
What does a TTL of 0 mean?
It tells resolvers not to cache the record: fetch it fresh every time. Some providers use it during migrations. It increases load and latency, so it is a short-term setting, not a default.
Is DNS-over-HTTPS private?
It hides your queries from the network between your browser and the resolver, defeating passive eavesdropping and on-path tampering of record names. The resolver you pick still sees every domain you look up.
Can a domain have both A and AAAA records?
Yes, and most large sites do. The A record is IPv4, the AAAA record is IPv6. A client with both stacks usually prefers IPv6 and falls back to IPv4.
Why does my TXT record look cut off?
A single TXT string is limited to 255 bytes. Longer values are stored as multiple strings that must be concatenated. Nothing is lost; join the pieces to read the full value.
Related tools
Subnet / CIDR Calculator
Network, broadcast, host range and mask from CIDR notation.
Chmod Calculator
Octal ↔ symbolic Unix permissions, with checkboxes.
SSL Certificate Decoder
Paste a PEM certificate, see subject, issuer, SANs, validity.
WHOIS Lookup
Registrar, dates and nameservers of any domain.
MAC Address Lookup
Vendor (OUI) lookup plus the meaning of every MAC bit.
Base64 / URL / HTML Encoder-Decoder
Encode and decode Base64, hex, URL percent-encoding and HTML entities — with auto-detect, bulk lines and file drop.