dotvitals

DNS Lookup

Query any DNS record type for a domain and compare authoritative and resolver answers.

Try

Fix it here

These build the changes the checks above ask for, and validate them against the same rules.

Address record builder

Publish the A and AAAA records that make a name resolve, with the addresses that must never be published refused before you can copy them.

This is the zone the record is published in — the domain you can log in and edit DNS for. The exact name it answers at, bare or a subdomain, is the next question.

TTL and migration plan

The order to make a DNS change in, with the wait computed from your record's own TTL and stated in hours — and the step that puts the TTL back afterwards.

The wait before your change is safe is computed from the TTL already published in this zone, so the plan is only honest if this is the domain the record really lives in.

About the dns lookup

A DNS lookup asks a name server for the records published under a domain and returns them as they exist right now, rather than a cached copy from your own computer. This tool queries the domain's authoritative name servers directly, so what you see is the source of truth, not a snapshot that a resolver somewhere cached ten minutes or ten hours ago.

Each record type serves a different purpose. A and AAAA point a hostname at an IPv4 or IPv6 address, CNAME aliases one name to another, MX lists the mail servers responsible for the domain, TXT carries arbitrary text used for SPF, domain verification and similar protocols, and NS and SOA describe the zone's own delegation and authority. CAA restricts which certificate authorities may issue certificates.

Results include the time to live (TTL) for each record, which tells you how long a resolver is allowed to cache the answer before it must ask again. This matters most when you are planning a change: lowering the TTL well ahead of a migration lets old answers expire faster once you cut over, shortening the window where some visitors still see the previous value. Because different resolvers can briefly disagree during a change, comparing the authoritative answer against what a public resolver currently serves helps you tell a real misconfiguration apart from ordinary caching lag. If the authoritative servers already show the new value, the record is correct and you are simply waiting for TTLs to expire elsewhere.

Common questions

Which record types are supported?
A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, PTR, HTTPS, SVCB, DNSKEY and DS.
Why do authoritative and resolver answers differ?
Public resolvers cache answers for the record's TTL. After a change, they keep serving the old value until that TTL expires, even though the authoritative server already has the new one.
What is a TTL?
Time to live: the number of seconds a resolver may cache an answer before it has to query the authoritative server again.
Can I look up a subdomain?
Yes. Enter the full hostname, such as mail.example.com, and the lookup walks the delegation chain to find its authoritative servers.
What this tool checks (12 rules)
  • dns.records.aaaa-missing — The domain has no IPv6 address
  • dns.records.apex-cname — The domain apex is a CNAME, which the DNS does not allow
  • dns.records.caa-critical-unknown-tag — A CAA record marked critical uses a tag no authority understands
  • dns.records.caa-empty-issue — CAA forbids every authority from issuing a certificate
  • dns.records.caa-iodef-invalid — The CAA reporting address is not a usable URL
  • dns.records.caa-missing — No CAA record says which authorities may issue certificates
  • dns.records.duplicate-txt-family — Two TXT records of the same kind are published at one name
  • dns.records.no-address-record — The domain has no A or AAAA record
  • dns.records.ttl-too-high — Records are published with a very long TTL
  • dns.records.ttl-too-low — Records are published with a very short TTL
  • dns.records.txt-chunking-broken — A TXT record looks cut off at the 255-character limit
  • dns.records.wildcard-present — A wildcard record answers for every subdomain