tamper[box]

DNS tools

Inspect DNS answers and diagnose resolution problems.

Choose a check

Read record types, compare resolver answers, inspect delegation and DNSSEC, or follow reverse naming. DNS results are observations from the queried resolvers, not a guarantee that every cache agrees. Registration and availability checks live in the Domains, registration & hosting collection.

Tools in this collection

  • DNS Lookup

    Runs on server
    • Check where a domain points before blaming the app.
    • Answer differs by network? Ask Cloudflare, Google and Quad9.
    • Just changed a record? Ask the authoritative server directly.
    • Look up any record type over DNS over HTTPS.
    • Compare a resolver answer with the authoritative one.

    Ask Cloudflare, Google, Quad9 or the authoritative server for any record.

    • Changed DNS, but some people still see the old site? Compare the answers.
    • Just moved a site? See which resolvers still have the old IP.
    • Compare twelve public resolvers with the authoritative answer.
    • Waiting on a change? See the TTL still holding it back.
    • Users in one region see an old site? Check resolvers there.

    Has the change reached everyone? Twelve public resolvers against the authoritative answer.

  • TXT Record Lookup

    Runs on server
    • A service won't verify your domain? Check the records it can see.
    • Several SPF records? Spot duplicates that break checks.
    • Find out what each TXT record is for.
    • Record over 255 characters? Check how it is split.
    • Too many old verification records? List them to clean up.

    Read every TXT record of a name and what it is for, with length and string checks.

  • CNAME Lookup

    Runs on server
    • Moved or deleted a hosted service? Look for aliases left pointing at it.
    • Follow an alias chain to the name it finally resolves to.
    • Removed a cloud app? Find CNAMEs still pointing at it.
    • Worried about subdomain takeover? Catch dangling aliases.
    • Site on a platform host? See the target it aliases to.

    Follow an alias to its end and catch dangling CNAMEs that risk subdomain takeover.

  • NS Lookup

    Runs on server
    • Changing DNS providers? Check which nameservers your domain delegates to.
    • Changing DNS providers? See which nameservers are delegated now.
    • Updated nameservers at the registrar? Confirm they took effect.
    • See which provider runs each nameserver.
    • Edits not taking effect? Check you edit the delegated zone.

    List the nameservers a zone delegates to and the provider behind each.

  • SOA Lookup

    Runs on server
    • Investigate DNS updates and cache timing at the zone level.
    • Secondary servers out of date? Compare the zone serial.
    • New records slow to appear? Read the negative TTL.
    • Check refresh, retry and expire against RFC 1912.
    • Find the contact address published for the zone.

    Read a zone’s SOA field by field: serial, contact and timers checked against RFC 1912.

  • AAAA Lookup

    Runs on server
    • Check where IPv6 visitors are being sent.
    • IPv6 users cannot reach the site? Check the AAAA records.
    • Moved hosts? Confirm IPv6 points at the new network.
    • Find which network owns each IPv6 address of a name.
    • Planning IPv6 support? See whether a name has any yet.

    List a name’s IPv6 addresses and the network behind each one.

  • SRV Lookup

    Runs on server
    • Find the servers an app is told to use, and which it should try first.
    • Setting up SIP, XMPP or Minecraft? Check the SRV records.
    • See which server a client tries first, by priority.
    • Balancing load? See each server's share by weight.
    • Client cannot find its service? Check the record name.

    See which server a client tries first and the share each gets by weight.

  • CAA Lookup

    Runs on server
    • Trouble issuing a certificate? Check which issuers your domain allows.
    • Certificate request refused? See which CAs your domain allows.
    • Switching CAs? Check the new one is permitted.
    • Need wildcard certificates? Check issuewild rules.
    • See which authorities have already issued for the name.

    See which certificate authorities may issue for a name, and which already did.

  • DNSSEC Checker

    Runs on server
    • DNS stopped resolving after a change? Check for broken signatures or delegation.
    • Domain shows SERVFAIL? Look for a broken chain of trust.
    • Moving DNS providers? Check the DS record matches the new keys.
    • Rolled your keys? Confirm signatures still validate.
    • Find the exact link from root to name that fails.

    Follow the chain of trust from the root to a name and find the link that breaks it.

  • Reverse DNS Lookup

    Runs on server
    • Find the name attached to an IP address and whether the two agree.
    • Mail rejected for missing rDNS? Check the PTR record.
    • Strange IP in your logs? Find the name behind it.
    • Check that the name points back to the same IP.
    • Setting up a mail server? Confirm forward and reverse agree.

    Find the name behind an IP address and check that it points back.