DNS Lookup

Records, email setup, two resolvers side by side.

Try

Unlike the other tools, this one does send something out: your browser asks Cloudflare (1.1.1.1) and Google (8.8.8.8) directly, over HTTPS, and they see the name you look up. The site itself never sees it. Answers come from those two public resolvers and may be cached, so this is not a worldwide propagation check.

About

Look up a domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, or PTR for an IP address) and see what Cloudflare and Google each answer, side by side. Switch to Email to check a domain's MX, SPF, DMARC and DKIM records, with plain findings such as how many of SPF's 10 allowed DNS lookups the record uses.

What do the record types mean?: A and AAAA point a name at an IPv4 or IPv6 address. CNAME makes one name an alias of another. MX says where mail is delivered. TXT holds free text such as SPF policies and verification codes. NS names the domain's nameservers. SOA holds zone details like the serial number. CAA says which certificate authorities may issue certificates. PTR maps an IP address back to a name.
Why does it ask two resolvers?: Public resolvers cache answers, so two of them can disagree for a while after a change. Comparing Cloudflare and Google shows whether a change has reached both. The comparison ignores TTL and record order, because those differ naturally. Sites behind a CDN or load balancer also answer differently depending on who asks, so a difference on A or AAAA is often normal.
Is this a DNS propagation checker?: Not in the worldwide sense. It asks two public resolvers, not servers in many countries and not the domain's own nameservers. If both show your new record, most people will see it too, but it is not proof.
What does the Email check look at?: MX (where mail is delivered), SPF (which servers may send as the domain, including the limit of 10 DNS lookups), DMARC (what receivers do when SPF and DKIM fail) and DKIM (the signing key, at a selector you type or one of ten common ones). It only reads records. It does not send a test email, so it cannot prove mail is delivered.
Why can't it find my DKIM record?: A DKIM record lives at selector._domainkey.yourdomain, and the selector can be any name your mail provider chose. Type it into the selector box, or find it in the s= part of the DKIM-Signature header of an email you sent.
Does anything leave my browser?: Yes, unlike most tools here. Your browser sends the domain you type to Cloudflare and Google over HTTPS, and they can see it. Google is asked not to pass on your network location. This site never receives the lookup.
Why does a record I just changed not show up?: Resolvers keep an answer for the record's TTL and may serve the old value until it runs out. The TTL is shown next to each record.