DNS Lookup & Checker
Query DNS records, compare answers across Cloudflare, Google and DNS.SB, and check DNSSEC — instantly and entirely in your browser.
What this tool does
This DNS lookup tool queries public DNS resolvers directly from your browser using DNS-over-HTTPS (DoH). Enter a domain, choose a record type, and see the live records with their TTLs and DNSSEC status — no signup and no server in between.
- Lookup — A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR and SRV records.
- Compare resolvers — see whether Cloudflare, Google and DNS.SB agree, which surfaces propagation lag.
- Learn — a plain-English reference for every record type and what to check.
Lookup vs. propagation
When you change a DNS record, resolvers around the world update at different times as their cached copies expire. Comparing several resolvers shows whether a change has taken effect consistently. Because major public resolvers are anycast, this is a resolver-consistency check rather than a per-country propagation map — but it catches the most common “it works for me but not for them” situations.
Common uses
- Confirm an A/AAAA record points to the right server after a migration.
- Check MX, SPF (TXT) and DMARC records when email is not delivering.
- Verify domain-ownership TXT records for Google, Microsoft and others.
- Confirm name servers (NS) match your registrar after a transfer.
- Check CAA records before issuing a TLS certificate.
Frequently asked questions
How does this DNS lookup work without a server?
It uses DNS-over-HTTPS (DoH). Your browser sends the query directly to a public resolver such as Cloudflare, Google or DNS.SB and displays the JSON response. There is no Multi-Toolkit backend involved.
Why do resolvers sometimes return different answers?
Different resolvers cache records independently and may be at different points in a propagation cycle, so shortly after a change one resolver can still serve the old value. Compare mode makes these differences visible.
Is this a DNS propagation checker?
It compares answers across multiple public resolvers, which reveals inconsistencies during propagation. Because these resolvers are anycast, it is a resolver-consistency check rather than a per-country geographic propagation map.
What does the DNSSEC badge mean?
It reflects the AD (Authenticated Data) flag from the resolver. When present, the resolver cryptographically validated the record via DNSSEC.
Is my lookup private?
The tool itself stores nothing and has no backend. However, the domain you look up is sent to the public resolver you select, exactly as any DNS query would be. Nothing else leaves your device.