zvera
FREE DNS DIAGNOSTICNetwork Tools

DNS Record Lookup & Zone Inspector

Query authoritative DNS records across A, AAAA, MX, TXT, NS, CNAME, CAA, and SOA types. Verify email deliverability records including SPF and DMARC policies in real time.

Quick Definition

A DNS lookup queries distributed authoritative Domain Name System nameservers to translate a domain name into machine-readable IP addresses (A/AAAA), mail server destinations (MX), security policies (SPF/DMARC), and aliases (CNAME).

DNS Zone & Record Lookup

Quick test:
UNIFIED INFRASTRUCTURE MONITORING

Managing multiple servers, domains, and systems?

Monitor server health, network endpoints, website response times, and SSL expiration across all your client infrastructure from a single unified Uzvera console.

Explore Uzvera Dashboard →View Plans
DNS MASTERCLASS

Everything You Need to Know About DNS Records

The core building blocks of the Domain Name System, how records interact, and common troubleshooting steps.

The Essential DNS Record Types

The Domain Name System (DNS) is the distributed hierarchical database translating human-friendly names into machine addresses. Understanding each record type is vital for network and system administration:

  • A Record (IPv4 Address): Directs your domain name to the web server's 32-bit IPv4 address.
  • AAAA Record (IPv6 Address): Maps your domain to a modern 128-bit IPv6 address for future-proof connectivity.
  • CNAME Record (Canonical Name): Aliases one domain name to another canonical name. Note: Under RFC 1034, a CNAME cannot coexist with other records at the zone apex (@ / root domain).
  • MX Record (Mail Exchanger): Directs incoming emails to mail servers, ordered by preference priority.
  • TXT Record (Text Strings): Carries human and machine-readable data, indispensable for domain verification, Google Workspace setup, SPF, DKIM, and DMARC policies.
  • NS Record (Nameserver): Delegates a DNS zone to authoritative nameservers responsible for resolving records.
  • CAA Record (Certification Authority Authorization): Restricts which Certificate Authorities can issue SSL certificates for your host.
  • SOA Record (Start of Authority): Contains critical administrative metadata for the zone: primary nameserver, admin email, serial number, and zone refresh/retry intervals.

DNS Propagation and TTL Tuning

When you edit a DNS record in your registrar or DNS hosting provider (Cloudflare, Route 53, etc.), the change is instant on the authoritative nameservers. However, the rest of the world queries intermediate recursive resolvers (such as 8.8.8.8, 1.1.1.1, or local ISP caches).

Migration Best Practice: 48 hours before migrating a production web server or changing your IP address, lower the record's TTL to 300 seconds (5 minutes). Once the migration is complete and tested, raise the TTL back to 86400 (24 hours) to maximize resolver caching and minimize query latency.

Common DNS Troubleshooting Scenarios

System administrators and developers frequently encounter several recurring DNS bottlenecks:

  1. Email Landing in Spam: Often caused by missing or misconfigured SPF records, or lacking a DMARC policy. Run this tool on your domain's TXT records and verify that your ESP's include statement (e.g., include:_spf.google.com) is present.
  2. CNAME Flattening Conflicts: Setting a CNAME at the root apex domain (example.com) strips MX and TXT records on non-compliant DNS providers. Use ALIAS or ANAME records, or utilize modern providers with automatic CNAME flattening.
  3. Split-Brain DNS: When internal office DNS servers resolve an internal IP (e.g. 10.0.1.5) while public DNS resolves an external IP (e.g. 203.0.113.10), causing inconsistent connectivity when workers travel outside the office network.
COMMON QUESTIONS

Frequently Asked Questions: DNS Records

Clear answers on records, TTLs, and email security configurations.

What is an A record versus an AAAA record?

An 'A' (Address) record maps a human-readable domain name (like example.com) to a 32-bit IPv4 address (e.g., 93.184.216.34). An 'AAAA' (Quad-A) record maps that same domain name to a 128-bit IPv6 address (e.g., 2606:2800:220:1:248:1893:25c8:1946). Having both allows dual-stack internet clients to connect using either protocol.

What does an MX record do and why is priority important?

MX (Mail Exchange) records specify which mail servers accept incoming emails sent to your domain. Each MX record includes a numerical priority (e.g., 10, 20). Sending mail servers attempt delivery to the lowest number first (primary mail server) and only fall back to higher-numbered servers (backup or failover relays) if the primary is unreachable.

How do SPF and TXT records prevent email spoofing?

TXT records hold arbitrary text strings for a domain. SPF (Sender Policy Framework) is stored inside a TXT record beginning with 'v=spf1'. It lists the specific IP addresses and mail relay providers authorized to send mail from your domain. Recipient mail servers check your domain's SPF record; if an unauthorized server attempts to send an email using your domain, the message can be rejected or marked as spam.

What is DMARC and why is it configured at _dmarc.yourdomain.com?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds upon SPF and DKIM. Placed at the subdomain '_dmarc.domain.com', it instructs receiving mail servers on what policy to enforce if an email fails authentication: 'none' (monitor only), 'quarantine' (send to spam folder), or 'reject' (block delivery outright). It also specifies an email address ('rua=') where aggregate authentication reports should be delivered.

What is DNS TTL (Time-To-Live) and how does it affect propagation?

TTL is a numerical value in seconds that instructs recursive DNS resolvers (like your ISP or 1.1.1.1) how long they may cache a DNS response before querying authoritative nameservers again. If a record has a TTL of 86400 (24 hours), changes to your IP address may take up to 24 hours to reach every user worldwide.

What is a CAA record and why should websites set one?

A CAA (Certification Authority Authorization) record explicitly declares which Certificate Authorities (such as Let's Encrypt, DigiCert, or Sectigo) are permitted to issue SSL/TLS certificates for your domain. This prevents rogue or compromised CAs from mistakenly issuing unauthorized certificates in your domain's name.

EXPLORE MORE UTILITIES

Discover more zero-login network analysis and web diagnostics tools.

🌐Network ToolsFree Network Tool

What Is My IP & ISP

Detect your real public IP, ISP provider, Autonomous System Number (ASN), approximate location, and network details without tracking or paid APIs.

  • IPv4 & IPv6 detection
  • ISP & ASN lookup
  • Approximate location & map
  • Branded PDF export
Open Tool →
⚡Website ToolsFree Uptime Tool

Website Status Checker

Check if any website is up or down, measure TTFB latency, inspect status codes, and follow redirect chains safely.

  • HTTP status code & text
  • Response time in ms
  • Redirect chain tracker
  • Safe headers & HTTPS check
Open Tool →
🔒Website ToolsFree SSL Tool

SSL Certificate Checker

Inspect SSL/TLS certificate validity, issuer, expiration countdown, Subject Alternative Names (SANs), and cipher suite.

  • Expiry days countdown
  • Issuer & Subject CN
  • SAN wildcard matching
  • TLS version & cipher
Open Tool →