How this lookup works
Queries go to public recursive resolvers: Cloudflare's 1.1.1.1, with Google's 8.8.8.8 as a fallback. That means you see what most of the internet sees, including cached answers. The TTL shown is what the resolver reports: the time left before its cached copy expires.
Two record types live at special names, which we add for you:
- DMARC queries the TXT record at
_dmarc.<name>. - BIMI queries the TXT record at
default._bimi.<name>, or at<selector>._bimi.<name>if you enter a selector.
The record types
| Type | What it holds |
|---|---|
| A / AAAA | IPv4 / IPv6 addresses for a host name |
| CNAME | An alias pointing at another name; it can't coexist with other records at the same name |
| MX | Mail servers for the domain, with preference values (lower is tried first) |
| TXT | Free text: SPF, domain-verification tokens and other policies |
| SOA | The zone's primary nameserver, contact, serial number and timers (including the negative-caching TTL) |
| DMARC | The domain's DMARC policy (a TXT record at _dmarc) |
| BIMI | The brand-logo record (a TXT record at default._bimi) |
How to read the results
- TTL tells you how long a change could take to be seen: up to the old record's TTL for resolvers that cached it. See DNS propagation and TTLs.
- Followed a CNAME means the name you entered is an alias; the records shown belong to its target.
- No records of this type (NODATA) means the name exists but has nothing of that type. NXDOMAIN means the name doesn't exist at all, and that answer is cached too, for the SOA's negative TTL.
- Findings flag a second SPF record in TXT results, a BIMI record without a certificate, and a CNAME at a zone apex.
Checking the source, not the cache
To confirm a change you've just made, query your DNS provider's nameservers directly (dig @ns1.provider.example name TYPE). This tool shows the cached, public view, which is what visitors and mail servers experience.
Updated 26 October 2026